* Posts by Robert Carnegie

4546 publicly visible posts • joined 30 Sep 2009

Putting the ass in Atlassian: Helpdesk email server passwords blabbed to strangers

Robert Carnegie Silver badge

After all, they didn't send your login and password across the internet to an unidentified stranger, in plaintebt... did they? Wait, that's a point. Did they? Do they still? (see "Iran", "BGP", this week.)

'Unhackable' Bitfi crypto-currency wallet maker will be shocked to find fingernails exist

Robert Carnegie Silver badge

Re: No need to hack anything?

Stealing the device physically and demanding a ransom isn't hacking. A device with substantial hacking resistance still can be worthwhile to have.

On the other hand, if this was just a cellphone and someone stole it, it would typically be findable remotely.

iPhone has that feature; I understand it also is fussy about interference with its internal parts. I don't have one, but it seems to me that an iPhone is a better one of what this is, than this is.

UK cyber security boffins dispense Ubuntu 18.04 wisdom

Robert Carnegie Silver badge

Re: Good idea.

Presumably ordinary users are urged to use a password-store program with long passwords because it's a good idea, and not just to annoy them. But what do I know?

I have a password-store at work; I have to input 3 passwords to open it. One of those is "password". I don't actually use it to store passwords in. If I did, then they wouldn't be behind "password".

Early experiment in mass email ends with mad dash across office to unplug mail gateway

Robert Carnegie Silver badge

Re: Career-limiting

I suppose you could try to pretend that you thought Peter Principle was the name of a very famous engineer - the youngest chief engineer in Starfleet or something. Scotty has a nephew named Peter on board in "Star Trek 2"; it could work.

Sysadmin trained his offshore replacements, sat back, watched ex-employer's world burn

Robert Carnegie Silver badge

Re: Timing is everything

I think muscle power goes by two-dimensional cross-section, but I may have to look into that. On the other hand, some superheroes who can shrink to 3 inches or smaller don't lose any of their mass. Presumably they don't lose any strength either. But technically this isn't science... C. B. Fry was supposed to be able to jump onto an ordinary mantelpiece; so can a cat. Not every person can do it; not every cat can...

Malware targeting cash machines fetches top dollar on dark web

Robert Carnegie Silver badge

Why wouldn't software that gets you free money - albeit illegally - be worth more than anything else?

On the other hand, if it works, then why does it have a retail price at all? Why do the people who can get unlimited free money, want your money?

Is that a rat I smell? Maybe!

Boss helped sysadmin take down horrible client with swift kick to the nether regions

Robert Carnegie Silver badge

Re: Clickbait headline?

Now I've forgotten what I was going to say. It may have concerned sexual harassment of IT workers and some improbability, although that wasn't what this story was about, either. Well, if not that, then whatever I meant may come back. By the way, I meant "what ISIHAC used to call", specifically, the late Humphrey Lyttelton's output device - not the trumpet but a record player. Or in this story, the output plotter.

Robert Carnegie Silver badge

Clickbait headline?

Thanks and bye and all that, but - this headline led us to expect something that wasn't delivered and was long wanted, namely, a kick to the user instead of ISIHAC used to call the "reproduction equipment" - and a lasting solution to the "Problem Exists between Chair and Keyboard" error when the user can't sit down for a while. Of course they would have to be very bad to deserve that.

Something else occurred to me on Friday which may have been the reason I wasn't allowed to post the comment then, so I'll try it later to see.

Dust yourself off and try again: Ancient Solaris patch missed the mark

Robert Carnegie Silver badge

A case of "not many eyes" perhaps?

No big deal... Kremlin hackers 'jumped air-gapped networks' to pwn US power utilities

Robert Carnegie Silver badge

How?

Two words: power lines.

two more words: Carrington event.

By manipulating sunspots and the solar wind, Russian scientists were able to signal to the power company computer systems... but why would they even need to, if they can do the first thing!

Either my name, my password or my soul is invalid – but which?

Robert Carnegie Silver badge

@EnviableOne

I'm not quite sure I like this. Is it saying that I can't have password = 5000358745115 because someone else on planet Earth once had that password?

It's not actually my password, it is the bar code of Tesco Omega 3 linseed oil tablets - which may not do you any good, it turns out.

Robert Carnegie Silver badge

"By pressing down a special key - It plays a little melody"

In principle, whatever you type as password can be represented as character bytes in hexadecimal notation, or even just decimal (numbers). So, restricting the character set just means that each symbol has fewer random options, but you can make the whole thing more random again by making it longer. No special keys required.

In practice, when I assigned random hexadecimal codes as passwords for a fleet of servers, some were rejected. Not apparent why, but I got around it by changing the format from 1a2b3c to 0qz1a2b3c - the start always being 0qz, the rest being random.

When I had to change them all again, I used 1a2b3cqz0 - new random numbers, and qz0 at the end, so that the new password wasn't "detected" as "too similar" to the old one.

Also if there is a fixed length - such as Wi-Fi key - then don't skimp on the randomness. I think that random alphanumerics are good enough in practice, though - although each character has about 5 or 6 bits of individual self-expression instead of 8. But a sentence in English has about 1 bit per character of variety, I think.

Robert Carnegie Silver badge

p!a!s!s!w!o!r!d!

It's not really safer. And some systems choke on non-alphanumeric symbols in a password - I suspect one of our systems can't take a !

A password of 8 genuinely random letters is safe. I standardise on Abcdef78 - as format, not as actual password - as concession to stupid system rules (and with all consonants, like I think I said above), and I put ! at the end if I really have to. But a password of a word with $ for S isn't safe because hackers have already got all those combinations in their dictionary.

Robert Carnegie Silver badge

Re: Idiot password checkers

For a password to remember, and easy to type: 6 random distinct consonants, then 2 numerals. I usually grab 20 letters https://www.random.org/strings/?num=1&len=20&upperalpha=on&unique=off&format=html&rnd=new - shuffle at random and pick out letters that fit e.g. Robert Carnegie -> Rbtcng95 (I don't actually use my name for this). That's the password, but to remember it, pick words that represent 5 or 6 of the letters. I find that after a few days, remembering the words e.g."Robot carnage" (possibly my name spell checked) brings up the letters and the numbers as well.

An online password checker spotted that "Fiqbly45" contains a given name (Bly) and a dictionary word (Fiq with a Q, evidently), it must be a fiend at Scrabble.

Microsoft Visual Studio Code replumbed for better Python taming

Robert Carnegie Silver badge

Intelli-thing for SQL Server 2014

For SQL scripting... I haven't looked at it closely, maybe it can be improved. My issues with it:

1. If you write something wrong, it gets underlined red. So you correct it... and it takes a second or two for the red mark-up to go away. Long enough to think "What else is wrong with... oh I get it."

2. One error is to refer to a data table that doesn't exist. So, create the data table... the "error" stays marked as an error, even though it isn't. If the list of existing objects can be refreshed, I'd like to know how.

As Corning unveils its latest Gorilla Glass, we ask: What happened to sapphire mobe screens?

Robert Carnegie Silver badge

Re: Seems obvious ...

Cats like to lie on a warm place...

Robert Carnegie Silver badge

Maybe it was one of those ultrahard bollards with diamonds in :-) Rather oversold in my opinion as terrorism and ram raider prevention, but they are pretty!

Fukushima reactors lend exotic nuclear finish to California's wines

Robert Carnegie Silver badge

Putting the "terror" in "terroir" ... "I Have No Mouth And I Really Need A Drink So Basically I'm Stuffed".

I think you might as well go back to the anti-freeze method.

Robert Carnegie Silver badge

Radioactivity, wild boars

...what -were- they putting in the magic potion in that indomitable Gaulish village? (besides tea leaves, canonically established :-)

Elon Musk, his arch nemesis DeepMind swear off AI weapons

Robert Carnegie Silver badge

Re: Pugwash 2.0?

We need the AIs themselves to make the pledge, not just the fleshy masters. Solved...ish.

Get rich with Firefox or *(int *)NULL = 0 trying: Automated bug-bounty hunter build touted

Robert Carnegie Silver badge

Dilbert 26/07/1995

http://dilbert.com/strip/1995-07-26

"I was this close to making it my job..."

Declassified files reveal how pre-WW2 Brits smashed Russian crypto

Robert Carnegie Silver badge

Outsourcing.

Ass, you, bitten in.

Robert Carnegie Silver badge

A foreign language isn't code.

It takes years to learn a foreign language properly, and people whose language it is can immediately understand you... unless you're dreadful.

A dictionary of under 100 common words in any language liable to be used in this way should make it veey easy to detect.

Adtech-for-sex biz tells blockchain consent app firm, 'hold my beer'

Robert Carnegie Silver badge

According to Abba

"Lovers (Live a Little Longer)"

Medically proved apparently, or maybe it just SEEMS longer...

Robert Carnegie Silver badge

Re: This is incredibly misogynistic alright

To answer you:

The following appears to be a joke about a Jewish gentleman, which may be a required detail.

He was talking to a friend and said, ”I prefer to sleep alone. I believe in celibacy. In fact, ever since we were married, my wife and I have had separate rooms.”

’’But,” said the friend, ’’supposing during the night you feel that you would like a little love, what do you do?”

”Oh,” replied the other, ”I just whistle.”

The friend was astonished, but went on to ask, "But supposing it is the other way round and your wife feels that she would like a little loving - what happens then?”

”Oh,” he replied, "she comes to my door and taps, and when I answer says, 'lkey, did you whistle?’”

Leatherbound analogue password manager: For the hipster who doesn't mind losing everything

Robert Carnegie Silver badge

Re: It's easy to improve security by using this...

I found it pretty hard to decide what to write on my replacement bank card as a reminder to self not to use the old PIN. The catch being that this could look like a disguised way to write down the new PIN, making the card more attractive to steal.

I decided in the end on - "Remember they gave you a new PIN number so don't use the old one", in capitals.

Robert Carnegie Silver badge

It's small enough

Roughly the area of a credit card. So you can store it somewhere very, very safe.

Just as long as no one watches you getting it out.

Open plan offices flop – you talk less, IM more, if forced to flee a cubicle

Robert Carnegie Silver badge

Re: Monasteries had it right centuries ago

"Translated from Arabic" doesn't sound like Christianity was all that responsible for carrying knowledge through the Dark Ages. Rather, it was responsible for there BEING Dark Ages.

Robert Carnegie Silver badge

Flawed experiment design?

"a 'sciometric badge' that was worn around the neck"

If I sit at my computer monitor and talk to people around me, the "sociometric badge' will only see me apparently talking into my computer screen. And likewise the people I'm taking with. With cubicles, you have to leave your computer and find someone to talk to... unless "cubicle invasion" is a thing where you are. See Dilbert cartoon (of course): Friday January 12, 1996.

Gemini goes back to the '90s with Agenda, Data and mulls next steps

Robert Carnegie Silver badge

Top wish = backlit keyboard?

Don't people touch type, by feel? Well... a small LED light that plugs into its USB would be another option. It comes as USB-C though?

Gentoo GitHub repo hack made possible by these 3 rookie mistakes

Robert Carnegie Silver badge

The problem seems to be that someone guessed that the password carnegie-123412341234-register (if it was me and Reg, which it wasn't) was a stonking clue for carnegie-123412341234-gentoo

I sometimes download random data to compose a password... but then I rearrange the characters before use. Then even the random provider can't guess what my password is. Two minutes later, neither can I, but I also write 'em down. Where I keep 'em, you'd have hurt me to get it... and if you're prepared to hurt me, then most people in my position would say you can have it.

I'm told by the automatic tester at https://www.my1login.com/resources/password-strength-test/ - another questionable web site, because all are; ironically, this is all that we use it for - that my typical formula of 6 random distinct consonants and 2 numerals is "as secure as Fort Knox" and takes 47 years to crack. I haven't actually used Xcsqpd14 as a password though. My formula fits password enforcement rules in most places; some demand a non-alphanumeric character as well. Twits; random is random is unguessable. They get ! at the end. However, one of our systems also uses ! as an escape character...

As for remembering the bollocks, it might not work for you but currently I'm converting either 5 or 6 of the characters into a semi-memorable phrase that reminds me of the password. This doesn't work first time but eventually does, with the rest of the password returning to my working memory as well. Then of course they make you change it... For Xcsqpd14 let's see... "excuse quip" (excuse pronounced as the verb, if it matter) works as a purely mental hint for Xcsqp ...

Uh-oh. Boffins say most Android apps can slurp your screen – and you wouldn't even know it

Robert Carnegie Silver badge

Um

I may be behind the time, but isn't this apps just being able to read screen data that the app itself is displaying? So presumably already knows about... only for some reason it's just easier to read it back from the screen.

Registry to ban Cyrillic .eu addresses even if you've paid for them

Robert Carnegie Silver badge

Pot, kettle

How do you get to "Equador" from .ec ? ;-)

In English the country is "Republic of Ecuador".

In Portuguese it is "Equador".

The country is Spanish speaking, however. So, "Ecuador".

The Municipality of Equador is in Brazil, which is almost all that Wikipedia (en) has to say about it.

IBM memo to staff: Our CEO Ginni is visiting so please 'act normally!'

Robert Carnegie Silver badge

I think it doesn't mean don't use the toilet, it means don't use the toilet as an excuse to meet the boss's boss and pitch your idea for Bluetooth underwear.

Of course - they already know what the office looks like, because of the cameras. Toilets included, probably.

Infamous 'Dancing Baby' copyright battle settled just before YouTube tot becomes a teen

Robert Carnegie Silver badge

If you're referring to a copyright holder having to consider fair use before sending a DMCA complaint, but being entitled to do that consideration on their own, I don't think that's problematic. Otherwise, every single DMCA complaint would have to be judged by a third party. I'll guess that most unlicensed uses of copyrighted material are blatantly not fair use.

We need to remember however that a young person is involved, presumably attending a school where every other student will have seen that video this week. I'm out of touch with the youth of today but I assume this is still novel and embarrassing.

Microsoft has another crack at fixing Chrome problems in Windows 10

Robert Carnegie Silver badge

Re: It's incredible to me ...

BASIC? It's just not the same without the RENUMBER command.

Robert Carnegie Silver badge
Joke

Re: I was surprised

We apologise for failing to corrupt your Start Menu during Windows Update. Please bring your PC to a Customer Servicing Center , in order that our engineer can satisfy you manually.

On Kaspersky’s 'transparency tour' the truth was clear as mud

Robert Carnegie Silver badge

Re: "murder your family" vs either Dr Kelly, or the sports bag victim.

I think the story about Dr Kelly was that his wife would be left without support of his government pension unless he kindly committed suicide. As this is broadly before there were food banks, presumably she/they would then starve to death. HTH, HAND

GitLab's move off Azure to Google cloud totally unrelated to Microsoft's GitHub acquisition. Yep

Robert Carnegie Silver badge

Re: Any takers?

"and then putting the back end into the public domain"

How very dare you!

GDPR forgive us, it's been one month since you were enforced…

Robert Carnegie Silver badge

Re: All of which just proves....

"I have sent them details on UK companies which are in multiple violations of both the old law and GDPR itself and which continue to blatantly market and sell your (out of date) personal data without your personal permission. With company numbers, addresses, the lot. They are happily scratching their nether regions instead of enforcing it."

Be sure to register your account with those companies using a tasteful fake nude picture of a randomly selected Member of Parliament. "Calendar Girls" level, with the face Photoshopped on. This either might get something done, possibly to you, or, if not, is at least slightly amusing, especially if it's Facebook and they are facially recognised.

Microsoft loves Linux so much its R Open install script rm'd /bin/sh

Robert Carnegie Silver badge

Re: Typical installer written in a large company

About installer gurus: someone who can do one thing well may be called "idiot savant". Some proudly self-apply the term (which is in French). It means your job is secure until it's automated or superseded (containers?)

New York State is trying to ban 'deepfakes' and Hollywood isn't happy

Robert Carnegie Silver badge

"Deepfake"

If I'm following this, "deepfake" is what's not obviously fake - and may be passed off as genuine.

Internationally, several elections have had voters asked to decide whether some alleged leaked phone calls of candidates doing illicit things were genuine or falsified or creatively edited. Presumably some are real and most are not.

If Disney wants to dramatise public figures misbehaving from hearsay, they can make cartoons. This would tell the story would not be mistaken for real video. They made a cartoon where Donald Duck was a Nazi German (but he was just having a nightmare). More recently, the controversial Taiwanese "Next Animation Studio" has been providing cartoon dramatisations of news stories for years.

As for performing with animals, Snow White and Mowgli sang alongside animals on screen. Gene Kelly danced with Jerry Mouse from "Tom & Jerry". Andy Serkis by now can probably play as any creature on earth or under it. I'm not sure if I have a point in this paragraph.

This HTC U12+ review page is left intentionally blank

Robert Carnegie Silver badge

You've reviewed it.

"It's fatally buggy. Don't buy it." If the product gets fixed, then you can review it again.

Having said that, is there an option to not touch the phone at all and do everything by voice control? Sorted! That should work for temperamental iPhones as well!

Sysadmin's PC-scrub script gave machines a virus, not a wash

Robert Carnegie Silver badge

Re: Should I be admitting to this?

One of my old favourite newspaper quotes from BBC radio's "News Quiz" (listen tonight for extended programme):

"Asked if she had anything to say before sentence was passed, Mrs Buckingham told the court: 'I have worked for British Rail for fifteen years. I am very sorry and ashamed.'" - Yorkshire Post

Robert Carnegie Silver badge

Re: I can't forget some AV package...

Microsoft surely has sent out a virus on discs sometime. Maybe in the "TechNet" support package. And that's if you don't consider Windows itself or the Office talking paperclip to be viruses.

Not to mention hoaxes like: (safe, probably.... you trust me don't you??)

https://www.snopes.com/fact-check/jdbgmgrexe/ "(Teddy) Bear Virus"

Robert Carnegie Silver badge

Re: Valentine's day virus

My boss got the ILOVEYOU e-mail - or something similar - and it did cross his mind that it could be a virus. So he didn't open the attachment. Instead, he forwarded it to me, to ask my opinion. Which was that he was out of his league. Also, out of his mind.

Uber 'does not exist any more' says Turkish president

Robert Carnegie Silver badge

Re: Good. Lyft, Uber & their ilk suck arse.

If Uber's business model is to destroy competition then overcharge, independent drivers will compete by putting themselves on Tinder or something. Picture of a car will be a clue to what type of ride is on offer. Could still lead to misunderstanding though if it catches on, so do clearly state how far you want to go.

IETF wants packets to prove where they've been, to improve trust

Robert Carnegie Silver badge

BGP misuse

I think it's called that... it's possible for a national Internet provider in Russia or China to announce itself as the quickest route to Google or Apple or TSB or whatever, so that all of the Internet is sent to that provider. When this has happened, as I understand it has, it usually appears to be by accident. but you never know.

I assume that this secure traffic mechanism does allow more than one secure route to be declared permissible, so that if one of your data centres suffers a power cut or a tactical nuclear missile strike then your network keeps running, bout I don't know about it.

Zimmerman and friends: 'Are you listening? PGP is not broken'

Robert Carnegie Silver badge

Not worst bug, worst brand.

They don't like the name EFAIL.

I'm waiting for some issue of timing accuracy to be codenamed NOTAPROBLEM. Try getting a budget to fix that.

Trio indicted after police SWAT prank call leads to cops killing bloke

Robert Carnegie Silver badge

Blackstone's Police Operational Handbook

ABC for police (British):

A, Assume nothing.

B, Believe nothing.

C, Challenge - and check - everything.

D, don't go in shooting, you stupid idiots. (Apparently not in the British handbook, the last I heard, but, should be)