* Posts by John Smith 19

16330 publicly visible posts • joined 10 Jun 2009

74 countries hit by NSA-powered WannaCrypt ransomware backdoor: Emergency fixes emitted by Microsoft for WinXP+

John Smith 19 Gold badge
Unhappy

"A lot of NHS software was written by people at that time "

If Amber Rudd actually gave a s**t this is what should be investigated regarding the NHS attack.

1)Did the contractors decide to do this or did NHS management (IT or general) force them to?

2)Why haven't they stripped this BS out of the UI code? Is the supplier extorting the NHS or are they just too incompetent (no docs on the code and all the devs have p***ed off)? My cursory look at this is that iSoft and Cerner seem to be the main culprits but I'm no expert.

I'd suggest the real scandal is that 17 years after it's release (and 2 years after MS dropped support for it) the NHS still seems shackled to an OS that's what 2,3 generations behind the current desktop release.

And BTW how many of those PC's actually access that core software?

John Smith 19 Gold badge
Unhappy

"Worst case scenario: Someone unleashes on Christmas Eve."

Indeed.

Timing the release of a major malware event at a time when the people being targeted are least able to respond to it would clearly not be the act of a gentleman.

OTOH since they are malware writers should you be very surprised that they would?

John Smith 19 Gold badge
Unhappy

"Why did they put it there in the first place though?"

Simple. The NSA does not (in theory) work for itself. Such attacks are a policy decision.

And if the policy changes you have to be able to shut it down.

Likewise if you target a group of businesses in order to gain access to an installation once inside and spreading any further infection is unnecessary. Ideally you want the other copies to also self destruct to prevent hardening against them (or perhaps having them used on yourself?)

The documentary "Zero Days" on Stuxnet mentions this stuff briefly.

John Smith 19 Gold badge
Unhappy

"..a binary system of TLAs &black hats, in effect working together to crap on the rest of the world"

From the PoV of most people who have to support IT systems there is no difference between these groups. I don't give a f**k what their motivations are.

Developers who work for TLA's. You are not keeping the world safe for Democracy/Socialism/Islam. These are stories you tell yourself or are told to you.

This is you

IRL the best assurance of a "safe" world (WTF that is) is safety and privacy for everybody, rather than surveillance of all under the nebulous excuse of "protecting" society from the usual 4 Horsemen.

John Smith 19 Gold badge
Unhappy

"(although the TLAs and politicians are too dim to understand their complicity in this)"

Oh they see it.

They just don't wish to acknowledge it.

"No man's ignorance is so great as a man whose livelihood depends on that ignorance" Upton Sinclair.

They believe that these weapons can be secured the way nuclear, chemical and biological weapons can be secured. If you steal one of those you'll leave traces (and probably kill or injure yourself in the process).

They are wrong.

John Smith 19 Gold badge
Unhappy

"I'd guess through a privilege escalation code flaw. "

Not even necessary in the NHS as El Reg has reported many of those patient management systems (which IIRC are the prime reason the NHS has not updated, since they don't run on anything but XP) only run with Admin rights.

Presumably any US hospitals that have been hit by this were in the same state.

John Smith 19 Gold badge
FAIL

"the SMB server bug is the result of a buffer overflow in Microsoft's code. "

BTW People make a big thing about XP but this SMB stuff is in all versions of Windows.

Remember when MS claimed they'd spent $Bn training their devs to not write insecure code and totally re-written the code base to eliminate these flaws?

How do you know when you're dealing with a monopoly?

Simple. When s**t this serious still does not force CTO level management to think "Maybe I should think about running something else on the desktop?"

FBI boss James Comey was probing Trump's team for Russia links. You're fired, says Donald

John Smith 19 Gold badge
Joke

Trump: "I Wanted to fire him the day after I was inaugurated"

"I never said this out loud but it's a fact I thought it from the first day in office."*

*yes this is fake news.

John Smith 19 Gold badge
Joke

"So that's who is going to play the part of the idiot-in-chief"

While on the surface this sounds completely ba***it crazy that actually sounds like a plan to me.

Let's do lunch.

John Smith 19 Gold badge
Facepalm

"I do wonder when Nixon's nickname will be..changed to "Respectable Richard".

Umm, never?

Tricky Dicky's behavior requested getting his aides to organize burglaries of political opponents. That's never going to be acceptable.

We'll see how the D's behavior shapes up the next 1350 days.

Along with the hands on the Doomsday Clock of course.

John Smith 19 Gold badge
Unhappy

"Maybe cheeto will fire the Congress next."

You know, deep down, he's not a natural democrat. His preferred form of government (were he to spend the time actually articulating it) is aristocracy in the literal sense of the word IE "The best rule."

And by "best" of course he means himself.

John Smith 19 Gold badge
Unhappy

"and promised we'd get the situation back under control in about four years. "

Sadly I'm not quite so optimistic. Rumor has has it the D has already worked out his 2nd term election slogan.

"Keeping America Great."

Catchy, don't you think?

1350 days before he tries it out.

John Smith 19 Gold badge
Coat

"So not only does the Trumpeter have small hands, but he's not got all his marbles?"

Just saw "Deadpool" again.

Are they KFC Spork small?

John Smith 19 Gold badge
Coat

"Richard Nixon. Another guy who absolutely did nothing wrong while in office."

"There's no White wash in the White House."

Turned out, there was.

John Smith 19 Gold badge
Unhappy

"nothing to see here, really."

Indeed.

Trump supporter produces fake news (massive haul of sensitive emails is not massive haul) and Trump shows him the door.

Here's an old fashioned idea. Let's try to get a consensus on what the Congress should do.

How about

1)There is evidence that serious efforts were made to influence the outcome of the last Presidential election by at least one foreign government.

2) This is wrong.

3)The Congress should investigate

a)What efforts were made b) Which powers were involved c) Wheather they were successful d) What should be done about it e) What should be done to stop it happening in future.

I think that's an agenda every member of Congress and the Senate could get behind.

Comey was loathed by the left, reviled by the right – must have been doing something right

John Smith 19 Gold badge
Unhappy

"Key Escrow" IIRC that was the "Clipper" chip mentioned in "South Park, The Movie"

And viewed at the time by the security industry as a prime PoS.

John Smith 19 Gold badge
WTF?

" created at manufacture and only stored by (say) the FBI/NSA/GCHQ"

And you don't see the flaw in this cunning plan, following the Edward Snowden documents release?

Think carefully.

Trump signs executive order on cybersecurity, White House now runs the show

John Smith 19 Gold badge
Coat

" Let the pros handle business without any of your fuckery Donnie. "

Yeah, but y'know DJ Trump is in the (White) house now.

John Smith 19 Gold badge
Happy

"The tiny hand wrecks the cradle."

Well played, sir.

John Smith 19 Gold badge
Unhappy

Is anyone else wondering if he'll read any of them?

Because as others have noted he's reputed to have a very short attention span. I'd suggest.

Brevity in the whole thing. But keep all the evidence in a bit Appendix you can show him if he complains it does not look like you've doing much work.

3-4 conclusions of a couple of (short) sentence each.

Like every boss for any problem you raise he wants to hear a solution. Better yet a couple of them.

John Smith 19 Gold badge
Coat

"will ask each agency for a feasibility plan for combining IT infrastructure for departments "

Could we call this "shared services by the back door?"

He might like to have a little chat with his new BFF Mrs May on how well that's worked out in the UK.

Of course done right it could result in yuuge cost savings

Warm, wet, mysterious... sound familiar? Ah, yes, you've heard of this second Neptune, too

John Smith 19 Gold badge
Thumb Up

" it may be telling us that there’s more to planet formation than we expect."

Depends what the full theory says about such planets.

If it says "impossible" then it's clearly wrong since this work proves it's not.

If it says "Unlikely but possible given certain parameters" then the question is wheather this solar system meets those parameters, assuming they can be measuered. If it does then the theory is still sound. If not (or they can't be measured) there's more work to be done.

Exciting times.

HP Inc ships laptops with sinister key-logger

John Smith 19 Gold badge
Unhappy

"I can think of ZERO reasons why a headphone driver needs to log keystrokes."

My point exactly.

"To pick up activating hotkeys" is the usual explanation but doesn't Windows have a separate way to "register" an app to recognize only those keystrokes as a shared resource in the keyboard driver?

If it doesn't (and after 30 years you'd expect there's a function for damm near everything in there somewhere) WTF is it now writing every key to a file?

There is one use for this. If logs every keystroke your hard drive will fill up with lots of hidden crap files, causing you to replace your laptop earlier.

That would be a grossly cynical piece of behavior on the part of HP of course.

John Smith 19 Gold badge
Unhappy

WTF is this thing and why does it do what it does?

Which is what I think people would like to know.

Another IoT botnet has been found feasting on vulnerable IP cameras

John Smith 19 Gold badge
Unhappy

"I have their internet access cut off... they can't call out or be reached from outside."

I'd love to see if anyone has any statistics about what percentage of attacks is stopped cold just by doing this.

You'd think by now malware writers have found ways around this but my instinct is that it's still surprisingly effective.

John Smith 19 Gold badge
Happy

"What ports are open on my machine?" "I'm sorry, can you say that in English?"

Actually I can.

https://www.grc.com/x/ne.dll?bh0bkyd2

Follow the instructions and watch the pretty pattern form. If it's all Green it's a start. If it's partly Red go find someone who does know about these things and ask them for help.

John Smith 19 Gold badge
Go

"Infestation aside: yet another use for Duct Tape."

Indeed.

10 pack Duct Tape.

Not just for 'nappers and serial killers.

John Smith 19 Gold badge
Unhappy

"sold to and installed by people with no IT skills. "

Which if I would were callus about it would not bother me.

The problem is that s**t then starts attacking everyone else's stuff.

So instead of being a problem for the ignorati only it now becomes a problem for everyone.

John Smith 19 Gold badge
Joke

David Attenborough narrates....

Here once again the placid herd of internet camera users is surreptitiously attacked by this internet parasite. Noiselessly inserting itself into the heart of the users camera it is a voracious consumer of bandwidth and processing cycles, doing whatever it has been programmed to do.

John Smith 19 Gold badge
Unhappy

"more than a thousand different internet protocol camera models."

Or more likely 5 models with 200 odd resellers badges on them.

UPnP. The protocol that just keeps giving (control of your hardware to someone else).

I know it's infantilely stupid but shouldn't everyone start with the question "What ports are open on my machine?" If it's open do you know what it normally does? Are you happy to have it doing that?

If a port scanner scanned the addresses of your ISP what would they find?

Head of UK.gov's Common Technology Services Iain Patterson steps down

John Smith 19 Gold badge
Coat

What a great name for a civil servant.

Cunnington by name

Cunning by nature?

So your client's under-spent on IT for decades and lives in fear of an audit

John Smith 19 Gold badge
Unhappy

I kndo of see the benefits of this idea

It's operations for grownup installations, not BoH & PFY shops.

TensorFlow: I want to like you, but you're tricksy

John Smith 19 Gold badge
Unhappy

Re: The point is it's free and open

It's "complementary"

It's not free.

You just can't figure out how they will make you pay for it.

John Smith 19 Gold badge
Unhappy

A film recommendation website. Not that clever. OTOH

A system that watches the film for you and then tells you what you would have thought of it had you seen it would be pretty clever.

That really would be a case of the machine doing your thinking (and feeling) for you so you don't have to.

Yey. Progress is amazing.

Space upstart plans public cloud in low Earth orbit

John Smith 19 Gold badge
Unhappy

"This sounds much more like a VC-harvesting pitch than a sane plan. "

What he said.

John Smith 19 Gold badge
Go

So you're counter rotating the apps against the sat movement to keep a pseudo server overhead.

Which is damm tricky. Major kudos to any team that can make it work. Hardware wise the phrase South Atlantic Anomaly looms large. SpaceX took a while to devise radiation tolerant (IE resistant by architecture), rather than radiation hard (mfg in rad hard, v. expensive process) computer systems. And will those Intel based boards carry the epicly easy to access AMT processor (I'd call it a hack, but just-leave-login-details-blank doesn't really qualify) to manage this?

BTW a note on times. Time running on any particular server will depend on how long the bird is visible from the ground station. A full orbit at this sort of altitude is about 90mins so you could have 10s of mins if it's one bird/customer (which sounds unlikely). But how will you transfer context of running job from satellite to satellite?

3 LEO/MEO comms constellations were launched in the 90's. All are still running but all went through Chp11. Orbcomm does low(ish) bandwidth M2M and Iridium survives on the block buy of the USG.

I like optimism, but there's optimism and there's Forest Gump optimism. So let's see how much VC they can get.

John Smith 19 Gold badge

Re: Time for regulation?

Such requirements already exist and anyone launching from a specific country has to follow that countries plan. Since a lot of payloads have been launched from the US detailed requirements already exist.

John Smith 19 Gold badge
Unhappy

"More space junk and rare minerals burning up..doesn't really sound like the sanest plan ever?"

Like shipping laundry from the Klondike to Hawaii to be washed.

Yet that was done and people made money doing it.

You seem to think that sanity is a prerequisite for getting funding or making a profit.

IBM wheels out bleedin' big 15TB tape drive

John Smith 19 Gold badge
Unhappy

The ideal tool for TLA's looking to spy on everyone, all the time, forever.

What did you think this is for?

Sinister Orwellian uses aside you have a 15TB chunk you can just eject and when you want to double your capacity you buy another tape.

Thing about tape. Zero power storage. No fear of bits zapped by cosmic rays. HDD has 100s of parts and 10 of 1000s of connections, nearly all single point failures.

Yes tape drives are mechanically complex (but so were all designs of VCR's, and yet people managed to make those in large quantities to ever improving accuracy) but I've never understood why changers are so expensive other than "because we can charge that kind of money." I think there's a fascinating mechanical engineering research project to be had in adding a changer to a manual tape reader using 3d printing, because if you can meet the alignment specs once you publish the design anyone can do it.

US spymasters trash Kaspersky: AV tools can't be trusted, we've stuck a probe in them

John Smith 19 Gold badge
Unhappy

""He's a showboat, he's grandstander," "You know that,... Everybody knows that." ®

I think that's what psychiatrists call "transference." *

*Not fake news.

Bot you see is what you get: The cold reality of Microsoft's chat 'AI'

John Smith 19 Gold badge
Coat

" because no one really enjoys typing on mobile devices,"

Who knew?

Except journalists perhaps.

Memory biz Nantero is a right Dell raiser: IT giant flushes cash down RAM carbon nanotubes

John Smith 19 Gold badge
Unhappy

Sounds like a real "Holy Grail"* memory system

Fast as DRAM, less volatile than Flash, better shrinkability

*Of course the Holy Grail, as in King Arthurs drinking mug, is a myth.

We'll see.

Misery loves company so ServiceNow's built anonymous chat-rooms for the recently p0wned

John Smith 19 Gold badge
Go

TBH this all sounds quite good.

Although when I hear the phrase "circle of trust" I keep thinking of Rober De Niro and Ben Stiller.

Joking aside discretely informing companies your business works with there is a security issue without letting world + dog know sounds like a good idea (provided those you've told can do something at their end). It's not perfect but it would start action and that's better than nothing.

America 'will ban carry-on laptops on flights from UK, Europe to US'

John Smith 19 Gold badge
Unhappy

"And think of what this will do for Citrix and Cisco. Local companies make good!"

I wouldn't get too excited about that.

When Regan attacked Qaddafi's villa I figured US citizens would hole up and do most business by tele-conferecing.

Didn't happen.

Then 9/11 rolled by and I thought, That's got to hit the airlines hard. But somehow it didn't.

Logic says when you take their laptop off a senior business executive that's 90% of their reason for going somewhere, so why go at all? I think video quality is good enough and broadband speeds high enough it can feel like you're in the room and be able to pick up those non verbal cues people set such store by.

TalkTalk full-year profits rise but shares slump after raid on dividends

John Smith 19 Gold badge

Despite what people think there are about 100+ ISPs in the UK.

AFAIK only Vermin (spy on customers) and Sky (owned by Rupee Murdoch) have any shot at avoiding OpenReach controlled cabling.

So while basically all of them have to use the same back haul there's a huge difference between the best and the worst.

Crooks can nick Brits' identities just by picking up the phone and lying

John Smith 19 Gold badge
Unhappy

The fonejacker is dead

Long live the fonejacker.

"Yes hello there I need all of your bank details to authenticate who you are."

Secure email service builds newsletter bomb defences after attack pummels their inbox

John Smith 19 Gold badge
Unhappy

Seems like email signup should confirm they are dealing with a human, not a bot.

Because what's the point of sending a newsletter to somewhere that was signed up by a bot?

The rise of AI marks an end to CPU dominated computing

John Smith 19 Gold badge
Unhappy

They've certainly sold a lot of chips.

Lets see if they actually do anything useful.

Just so we're all clear on this: Russia hacked the French elections, US Republicans and Dems

John Smith 19 Gold badge
Unhappy

'Ol Dobby does love the latent dictator vibe.

Or maybe because he reckons lacking experience they will be easier to play?

Dobby knows authoritarians (which is what Le Penn and Trump are) love to be flattered and told they are "strong" and making "hard choices" (for the "greater good", naturally). It's pure coincidence their choices also benefit him.

How does he know this?

Simple. Because he's one himself.

It's 2017 and Windows PCs are being owned by EPS files, webpages

John Smith 19 Gold badge
FAIL

" 'Defender' aka 'Achilles'"

Nice (the use of language, not the result).

A bug in the default anti malware package that allows the right kind of malware to install itself without detection.

MS never disappoints.

When you think things can't get any worse....