* Posts by Lee D

4251 publicly visible posts • joined 14 Feb 2013

Sysadmin trained his offshore replacements, sat back, watched ex-employer's world burn

Lee D Silver badge

Re: Logic bombs are unprofessional

Sorry, but that you were using your own personal licence to run business functions reflects worse on you, but reflects badly on them whether or not they throw you out.

My first question would be: Who audited licences, was it included in the licence list, and why did nobody notice that the company hadn't paid for it?

And, no, I wouldn't have let you "uninstall" it, either. I'd have just disconnected and/or wiped the machine. If you don't understand why, you've probably never had to sack someone.

HPE supercomputer is still crunching numbers in space after 340 days

Lee D Silver badge

Re: "SSDs fail at an alarming rate in space"

Nonsense.

Hard drives, even with the best SMART monitoring in the world, fail unpredictably a large portion of the time. Any large hard drive survey will show you that.

And sometimes they fail so quickly even WITH SMART monitoring that you don't stand a chance of being able to do anything about it.

Reporting bad-sectors may be a symptom of imminent failure, but only so far as coughing up your lungs is a symptom of death. There are many other ways to die without doing that.

Lee D Silver badge

Re: "SSDs fail at an alarming rate in space"

Counterpoint:

Since replacing most desktops WD Blues with the cheapest-shite Crucial 128Gb SSDs, I've not had a single drive failure over 200+ machines in over 2 years, compared to several a year.

If you compare versus Seagate, including server-grade SAS drives, I literally got a failure a week on those after 6 months in deployment.

Your (or my) anecdotal evidence means nothing compared to someone like that cloud-storage firm who publish annual failure numbers across millions of drives.

I can name 4 private individuals whose hard drives crashed unrecoverably in the last year. I can't name one SSD anyway - in fact I've never seen an SSD fail, and I have a Samsung 850 EVO in my laptop for... 4 years?

P.S. All the SSDs I use do not experience any special treatment. I don't change a single software option (they were seen as a sacrificial in-production test where easy replacements - the original hard drives - were to hand any time I need them), no special write-caching, no disabling of swap, nothing... just a straight clone of the existing (sometimes years-old) image of Windows.

I'm not saying they're infallible. But in real-world, heavy user use, and worst-case configurations, where I expect them to fail... not one has so far.

2FA? We've heard of it: White hats weirded out by lack of account security in enterprise

Lee D Silver badge

Re: SMB

How would you get there without a) a RADIUS-authorised network port / computer, b) running network health reporting where Windows has to certify that it's online and clean and policy-compliant, c) your users would then have to log in via 2FA, d) only such users would be on that VLAN, able to talk to that server, etc.?

SMB is largely an exposed protocol. You don't 2FA that, you can't, not securely at all. You secure access TO the network that would allow you to see it. It's like asking whether WSUS requires 2FA... it shouldn't be exposed to people who aren't already authenticated properly.

P.S. multiOTP is a RADIUS server. Configured right your machines could use it for network access and you'd be stuck on an unprivileged VLAN without it.

But in reality for most setups, the 2FA here is "you're physically connected to the internal network and/or you've logged in over the VPN". Not "does SMB support OTP?".

Lee D Silver badge

Seeing as I just did this at my place, yes cost does come up. 2FA on Windows login is - indeed - stupendously expensive.

We rolled out multiOTP on all RDP remote desktops (with the multiOTP "credential provider" in Windows). Takes a bit of fiddling but free and compatible with Google Authenticator. There's LDAP integration and a Hyper-V test image if you want to give it a whirl, or it can run on any Windows server. Works for RDP on standalone machines (if you want to use it at home), not just terminal servers (with central querying and offline caching).

By default it only applies it to RDP logins on the machines you install it on. But it can also block ordinary logins and demand TOTP keys just the same, so test with RDP and if it works like you want, roll it out for all desktop logins. And it can also function as a RADIUS server which gives you a lot more scope for usage.

Wordpress we have deployed a 2FA login for.

I'm slowly working down to Exchange OWA and basic-website-wrapping (it's possible but it's a faff involving reverse proxies and splash screens). If anyone knows a good free solution for either, that doesn't involve that Microsoft Forefront thing, or emailled tokens (pointless for securing webmail!) then let me know!

At the moment looking at Apache wrapped in a module that pushes unknown users to a form, which can be used to query multiOTP but it's a bit of hack.

Google Chrome: HTTPS or bust. Insecure HTTP D-Day is tomorrow, folks

Lee D Silver badge

Re: stuck on HTTP

Any website without TLS can have its content modified on the fly by any entity in the path of the request/response.

Thus any website could have malicious javascript (coin miners, etc.) inserted into it, which the website or visitor wouldn't be able to detect, and the ISP could change adverts to their own, add tracking code (actual real-life cases, impacting your security and privacy, as well as the funding stream of the websites you visit, etc. etc. etc.), and all kinds of other issues - even something in your router (as per recent firmware problems with some routers allowing compromise by "redirecting" your web traffic.

HTTPS is a good thing. Just not sure about "by default". Technically, it's insecure. Yep. Absolutely 100% correct, so there's no problem highlighting that. The problem will come when it becomes difficult to say "Yes, I bloody know that's an insecure website for the billionth time, shut up already".

Lee D Silver badge

Re: It's funny to see that now...

"to a point where some countries and companies MITM every connection,"

They can only do that if you have physical access to the machines at either end, that's kind of the point of encryption. Commercial MITM requires you to trust a certificate that you would not encounter in the wild and would not be trusted by default in your browser.

Governments may be different but, pretty much, they can demand you just send them the data, they don't have to decrypt it - but to decrypt it requires the end-point's co-operation. You can't sniff a connection to Facebook from a Chinese PC without Facebook or the browser manufacturer being complicit - and you can't "break" it by using other certs without cert-pinning going ape and warning the user.

However, that said, working in a school I have a *legal requirement* to monitor every web access. Thus I have no option but to MITM every connection with an internal cert, and denying anything that doesn't present or tries to bypass that cert.

Unfortunately, it's just not as simple as "just work out what pages the user is looking at that they shouldn't" any more.

And that's just a UK school. Imagine what some of the big companies that deal with industrial espionage, military projects, etc. have to do to comply with what they need to..

As Corning unveils its latest Gorilla Glass, we ask: What happened to sapphire mobe screens?

Lee D Silver badge

Re: You are already getting what you want

An aftermarket case on a fragile object is in no way comparable to an object designed not to be fragile.

That's like saying "Hey, just wrap your car in bubble wrap because we forgot to bother with the bumpers".

Lee D Silver badge

Recess the screen. All this "fragile screen on top" nonsense has to stop. Even the Gameboy recessed the actual vulnerable screen and then put a clear-glass fake screen over the top. You look at every big-name portable device of long-ago... the Psions and so on. The screens are all recessed and bevelled. There's a reason for that... it makes more sense than this nonsense.

I would gladly pay more for a screen that's literally a flat-square piece of glass (thus cheap and easy to replace) recessed inside a plastic shell with rounded corners. As it is, I end up buying plastic cases that replicate just that scenario with the ridiculous "edge-to-edge" screens where the slighest impact destroys the screen and the surround can literally never be allowed to warp (I have 270+ iPads in front of me... all of the ones that are damaged, the aluminium casing has been whacked in shattering the glass and making it nigh-on impossible to repair... a simple rubber edge between would have saved them all except the ones that people literally trod on).

Windows Server 2019 tweaked to stop it getting clock-blocked

Lee D Silver badge

Re: 1 second

Think also of OTP tokens and things like that.

Don't account for leap seconds and in a couple of years time you are 30+ seconds out which means that no TOTP system (like Google Authenticator, banking apps, etc.) will generate the right codes if they are using different clocks that do (e.g. in a smartphone).

Leap seconds aren't that hard, and assuming everything from "I'll just count the seconds and divide by 365" is as blinkered as these kinds of omissions. If you're designing a major operating system designed to do everything from trade stocks to secure servers to integrate on a mass scale, date and time is very important to get right and there are enough gotchas that you already have to design around it, rather than bodge it in later.

UNIX started off on the right idea ("Store the number of microseconds that have elapsed since midnight 1/1/1970" and then account for all changes in the way that you DISPLAY them taking into account things like leap-seconds, time-zones, historical changes, etc. (i.e. convert to day, month, year, hour, etc.), not the way that you handle the number itself (which has little relation to real-time, but you can just increment it once a microsecond and have something else handle the logic of what that second was actually called - e.g. 01:59:59 or 01:59:60 or 02:00:00 etc.. when necessary.

Trouble is that it means keeping an accurate historical and future list of every change (and mistake?) made in those interpretations, for every timezone on the planet, etc. That's why you always just pull in date and time conversion functions and the "tz" packages, and NEVER try to fudge your own even if you think you know everything.

British Airways' latest Total Inability To Support Upwardness of Planes* caused by Amadeus system outage

Lee D Silver badge

Re: Why???

You'd also think that a place as big as Heathrow would be able to have a secondary air traffic unit on the other side of the airfield that could be used if, say, a fire alarm went off in one of them.

Fork it! Google fined €4.34bn over Android, has 90 days to behave

Lee D Silver badge

Re: You can't fork Android

And probably always will be.

I don't think this case will change that, no different to expecting Steam to open up their source code.

What they are arguing is that you can't FORCE people to use Google Play in order to use Android.

Lee D Silver badge

"the requirement to preinstall Google Search and Chrome"

- Yep, no need to force this on people. However, can we please learn that you need to be able to REMOVE THE JUNK THAT THEY PREINSTALL. Whoever "they" are. This will mean a lot of "Samsung Internet Browsers" being installed, fine, activated by default, fine, but it will also mean that they'll make it a pain in the butt (or even impossible) to remove them and JUST have Chrome even if that's what the user wants.

"payments to phone makers to make Google Search the default"

- Not sure how this hurts, as such, as surely other people could pay those makers to be the default? So long as it's changeable? Is this any different to Apple being paid to direct people to Google? That could hurt if that went to court based on this case.

"and restrictions on creating "forks" of Android."

- Yep, no need for this, they just can't call it an Android phone etc.

Samsung’s new phone-as-desktop is slick, fast and ready for splash-down ... somewhere

Lee D Silver badge

Re: ...however!

Mini projectors are cheap.

Lee D Silver badge

Developers?

And Dex isn't just about Android, is it?

https://www.theregister.co.uk/2017/11/10/linux_on_galaxy_video_demo/

Ubuntu and Eclipse. That could be perfect for a developer, web designer, etc. on the move as well as one who needs to test their results on mobile.

And the price is reasonable, much more than I would expect to be honest, but I can't afford the Samsung phone to go with it, so maybe that's why.

But I think I'd quite happily consider running Ubuntu off my phone as an emergency/portable desktop, if I was a salesman, developer, IT contractor, etc. Much more so than an iPad. Hell, I'd do it and just keep the Dex bit on me for the "just-in-case" of needing a laptop and not having one, or a presentation (plug phone into Dex into HDMI projector). You can also get a mini-projector for peanuts nowadays. You could have a full Linux desktop setup on an airplane seat with things that you can slip into your pocket.

It seems to me to have a lot of uses, it's just a shame that the phones to do it are so expensive (and even my old S4 Mini / S5 Mini could probably be a serviceable desktop with the right OS).

Microsoft to pay new bounties for identity services holes

Lee D Silver badge

I don't think there's much of anything like Banyan Vines left in AD, Samba would have found it by now if there was, I should imagine. Whether in inter-compatibility testing, or legacy protocols that they try to support, or anything else.

And given that Samba can be a full AD domain controller, I reckon they've had stumbled across / recommended against any such code.

Hell, to be honest, SMBv1 and v2 are already dead BECAUSE they're so insecure. That's how those worms of a few years ago propagated and even that was seen as "Why the hell does the NHS have that option enabled any more anyway?"

The crowd roars and Ruckus joins in with 802.11ax kit

Lee D Silver badge

Which is like not sending a response packet to a DoS.

They've still used up the airwaves, fought with existing clients, and spoke over them to request anything. Sure, you're not propagating that situation but without protocol changes there's no way to say "shut up and don't ask again" or isolate such requests from the parts that actual data-transferring clients are using.

Additionally, what you're doing then is ignoring random "who's there" probes, which is going to affect auto-join of all kinds (remember - the clients are dumb and may just be trying to connect to favoured network while connected to an unfavoured one, which they can't because you ignore their probes).

At best this is a minor tweak, that will impact legacy clients (maybe in protocol-breaking ways?) and not actually help all that much (e.g. if you have even 11Mbps clients, the probes are an incredibly TINY fraction of the data that they would transmit just to stay online once connected, and mostly passive - SSIDs are broadcast quite openly and clients pick up, they don't really transmit until you join - this is how the old WEP-cracking tools of old worked, they could determine the SSID and WEP key without broadcasting a single byte of data over the airwaves. It's the "thousands of clients" bit that's the problem, and ignoring a portion of them still doesn't make it any better - they're old so they're likely to re-transmit more often to get an answer!).

This is hype at best. If you are so congested that can't fit in a client scanning for SSIDs it might want to join, then you don't stand a chance of transmitting any kind of useful data to any connected client anyway.

10,000 clients sensing networks at even 11Mbps (i.e. taking up the most chunk of spectrum, while also taking the greatest portion of their allocated data to do so) is literally lost in the noise.

The problem comes not from the responses given, but the sheer "waiting time" for the airwaves to be clear before it's safe to broadcast any kind of request at all, and that's determined by the protocol of the client, not the AP.

Lee D Silver badge

That's all very nice but surely it requires everyone to be using 802.11ax on the client end too. As always, you still have to deal with legacy clients in legacy fashions, and as most things dial down to legacy connections when they get weak signal or bad responses, 99% of "heavy traffic" management is surely just dealing with the DoS from legacy clients.

And surely here one of the flaws is using the same channel for data as we do for client-querying. All those thousands of devices saying "What are you offering?" constantly shouldn't be interfering with a client that's already joined the network and is passing data, surely?

You wanna be an alpha... tester of The Register's redesign? Step this way

Lee D Silver badge

You've got time to pee about like that, but:

- No IPv6 still.

- You still can't link my old posts under previous usernames (but same id!) to the badge/stats

- I can't search through my own (or another user's) comments to find a particular thing I posted.

Capita strikes again: Bug in UK-wide school info management system risks huge data breach

Lee D Silver badge

Re: Gonna be one less school soon

Most MIS providers are no different.

What are you moving to? I betcha I can point you in the direction of someone with similar/worse horror stories on whatever it is.

Microsoft's TextWorld gives AI a Zork-like challenge

Lee D Silver badge

If it ever learns to quit vi then we know we're in trouble.

Crumbs. Apple has tweaked the MacBook Pro keyboard

Lee D Silver badge

God, the PC you could get for the same money that wouldn't have a pathetic 13" screen...

If I was GIVEN one of these, I'd flog it and buy a decent laptop and spend the difference on all kinds of stuff.

What can $10 stretch to these days? Lunch... or access to international airport security systems

Lee D Silver badge

"I'm gonna give you run of the complete IP network" rather than "I'm going to show you a picture of a machine that you'll have to log into"?

VPN is sensible, sure, but as an encryption layer only. VPN into a network as if you were plugged in locally is just a perfect way to spread stuff from their machines to your network.

VPN, and filter, and VLAN, and etc. etc. etc. and then to a limited network that only allows RDP traffic, through an authenticated gateway, only to select apps/VM's... yep. That sounds ideal.

But to most people, well-configured RDP - with up-to-date clients - to an unprivileged TS acting as a network client is perfectly sufficient in terms of encryption, stopping brute-force attacks, letting people work from hotels, etc., convenience, and compatibility (you can do it from an iPad, or a smartphone).

The question is not "what protocol do you use" but "what measures do you have protecting that protocol".

But, personally, blanket VPN access is incredibly dangerous. And most people want it "to access network shares", so you can't block the protocols associated with that. Now you have SMB/CIFS traffic flowing around uncontrolled home networks.

RDP, via a gateway, with certs, decent policy, IDS/IPS, and file-transfers disabled... it's then impossible to do anything that "that user logged in on a real machine inside" couldn't do, while also preventing all exposure of unsanitised data to/from their home / cybercafe / etc. IP networks.

Lee D Silver badge

Re: I was "hacked" via RDP

Do yourself a favour - get or write a script that emails you for every RDP login. There are loads of them out there.

There's nothing more reassuring than at least knowing "Hey, I spotted something odd that managed to slip past what I thought was secure!".

RDP has suffered several attacks recently (e.g. CredSSP), so patch it like mad, and check people aren't bypassing your password entirely.

'It's legacy stuff brute-forced in': Not everyone is happy with Citrix's cloud

Lee D Silver badge

Re: Good ol'terminal services stuff

Things like GDPR etc. kept us in-house.

Sure, put stuff in the cloud, but that just means "rent a computer somewhere with a good policy, encrypt it heavily, and control it yourself" in our case.

Citrix always seemed a con, for something you could do yourself better. Cloud Citrix just seems silly.

Geoboffins spot hundreds of ghost dunes on Mars

Lee D Silver badge

That's saffron-t to my sensibilities...

Google offers to leave robocallers hanging on the telephone

Lee D Silver badge

International calls? I get CLI all the time. I know because a lot of them like to use tricksy ones that LOOK like local calls but aren't (0027, etc.). I have one on my phone history today, if you'd like to see.

Unless, and this is important, it's spam. Then no CLI, international or not. But it's never answered.

I don't care that the local council use withheld numbers etc. That's their problem. They are one very, very specific example of exactly a place that SHOULD be pushing CLI properly with an official council number to call them back on clearly visible.

If you have to HIDE WHO'S CALLING then I don't want to take that call. Legit or not. Actual client/supplier/service or not. Known to me or not. Simple as that.

Yes, you can fake CLI (but it should be impossible, BT just need to pull their finger out). But every workplace I ever worked for has never felt the need to hide their number. All they do do is not advertise their internal DDI's and make the CLI of all calls go out with the main public switchboard DDI. There's no reason to be doing anything else, unless you're intending to deceive people about the origin of the call.

Those kinds of people won't want to answer the phone anyway, so no loss to just advertise the number at least for the first few calls anyway.

Plus, sorry, but nothing binding is done by me over a telephone call. You will email or write if you need it. And absolute best case: I'll call you back on your advertised number to ensure I'm actually speaking to who I think I am, and deal direct and still ask you for whatever-it-is in writing. You could request that via an SMS, if you wanted.

There is zero NEED for CLI. It's not even convenient as it can be easily faked or blocked. Hence it's about as reliable as a From: header in an email, and I trust it just as little. Because of that, I disregard them entirely and work on the much simpler principle of "I didn't give you my number, therefore I never wanted to hear from you."

Lee D Silver badge

Easier solution:

Whitelist by default.

If I don't have your number plugged into my phone as a contact, your phone call doesn't ring, or get answered.

If you're persistent then I might bother to Google you.

The magic keys to the kingdom of speech with me? Use a well-known number that I can search for online, inform me of your number/call in advance, or send me a text (if you're a human) to let me know who you are and why you're contacting me.

Otherwise, enjoy the glorious brrr-ing-brr-ing into perpetuity without even a possibility of leaving a voicemail.

P.S. My ringtone for real people is the sound of the phone ringing from the ZX Spectrum game Software House. True story.

Boffin botheration as IET lifts axe on 20-year-old email alias service

Lee D Silver badge

Re: Email forwarding services are passé

Nonsense.

Any email forwarding is easily coped with, and SPF can be simply added (it's IET's job to say what mailserver can claim to be from their domains, that's it - they could just leave an open record on it or offera basic SMTP sender with auth).

And envelope-rewriting and forwarding is supported by just about every domain-name host out there with email-forwarding. I forward ALL my public emails (which I use heavily for everything, personal and business, for 20+ years) to a GMail (ultimately, but that's unpublicised and can be changed in seconds) which I use as my actual method to collect and read and reply to those emails.

I also run my OWN forwarding server to do just that as secondary, to handle more critical domains, etc.. It's Postfix and maybe an hour of config for anyone familiar with Linux at all. That forwards to and isn't blocked by Google etc. unless it's quite obvious spam. My own grey-listing, SPF-checking, DKIM-checking, etc. spam filter blocks WAY MORE than GMail does, and it never touches even fresh incoming addresses at my domains (e.g. newsocialmediacompanyspamhole@mydomain.com) that haven't ever seen an email prior.

Their reasoning isn't based on that because it's hard. It's just an expense and liability that they don't need. Personally, I'd ask people for £100 per address per year and then bolt it into Google Apps for those customers who want to pay to retain it. Would take long at all, and no GDPR liability as you literally never touch their email. But I can perfectly understand why they wouldn't want to, it's just not their job.

BGP borked? Blame the net's big boppers

Lee D Silver badge

Oh look.

This is unprecedented.

"Failure to properly sanitise input data".

"Failure to apply least-privilege principles" (if it's not explicitly allowed, it can't happen).

"Failure to apply sensible defaults"

"Failure to check output of own systems matches expectations"

It's not like those EVER cause problems, is it?

Microsoft might not support Windows XP any more, but GandCrab v4.1 ransomware does

Lee D Silver badge

"Being able to spread without internet access and impacting legacy XP and 2003 systems suggests some older environments may end up at risk where there is poor security practice – e.g. no working antivirus software"

Poor security practice like running obsolete and unsupported operating systems, for example?

I think Microsoft should just be honest... if your system has XP anywhere on it, in any configuration, even as a VM, the rest of the network's security is pointless and cannot be guaranteed. Give it up, stop developing, testing and shipping software for it, let it on the kerb.

Until you do that, people will just keep running it forever and think that just because there's some ancient version of Sophos on it that it's somehow magically "secure" now.

Cops suspect Detroit fuel station was hacked before 10 drivers made off with 2.3k 'free' litres

Lee D Silver badge

Re: Outrageous!

A weak pound worth $1.32?

Sysadmin cracked military PC’s security by reading the manual

Lee D Silver badge

SWITCHES=/N

in your CONFIG.SYS.

Lee D Silver badge

Re: Bypass autoexec bat & config.sys..

1) You could disable that.

2) What makes you so sure it was MS DOS?

Lee D Silver badge

A bunch of machines in an IT suite that I was revamping for a school, all tied together with serious steel cables, attached to the machines with some quite serious adhesive on a plate secured direct to the metal chassis of the machines.

Because they were all interlinked, and the cables padlocked together, you couldn't steal one without the one next to it, and so on. I thought it was going to be a nightmare of having to reimage them all in-situ or going through a bundle of different padlocks key endlessly to separate them, but I thought I'd give things a shot to see if there was an easier way.

I knew that you couldn't just pull the computers apart by brute force - I'd witnessed one fall to the floor hard and just dangle there by the plate/cable, and seen a few cursory demonstrations by big strong men trying to pull on them.

But every system has a weakness. In this case, the hefty metal plate that was epoxied in some manner to the chassis that everyone assumed was inseperable. Like with a maglock, it's not how strong it attaches when you pull laterally against the lock, it's how you can break that lateral surface area connection.

Turns out, a small flatblade screwdriver inserted into a tiny sliver of a gap between the chassis and plate, and then a small "twist" rotation of the head at normal hand strength would easily separate the two surfaces. Despite the fact that you could probably tie the offending articles to two vehicles driving in opposite directions and only ever snap the cables not the attachment, once you got the hang of it, you could literally walk down the row, stab, twist, stab, twist and fire the plates off the machines at high speed with nothing more than a basic hand tool and hand-tight motion. And no damage to the machines.

Headmaster of the school came past about 20 minutes after he'd said he'd go get me the keys, saw the pile of hefty steel cables and plates on the floor and his now "insecure" IT Suite and was flabbergasted. We never bothered to put them back on. (And, yes, I had permission to remove them if I could, before you ask).

If I found it, you can be sure anyone determined to steal those machines knew it too, even if they hadn't brought bolt-cutters.

Similarly, schools all used to just buy expensive projectors and dangle them from their high-ceilings on long-rods. In time, people became aware of the necessity of a "swing test". Literally, if you can't swing from the rod with your full weight then it only takes seconds to get the projector down and walk off with it. Sure, you'll damage the hell out of the ceilings/joists, but burglars tend not to care if they can walk out with £1000 of kit in ten seconds.

Despite then being told by several places that "our projectors have to survive a swing test", never did find anyone who even suggested it was possible to build or fit such an item if you're just attached to joists and your ceilings are 14 foot height, so the pole has to be at least 8 feet long. They learned quickly that leverage and brute-force beats ingenuity every time. After that, they started to buy projectors that were marked educational use only (destroying resale value on the main markets), had passcodes to stop them turning on, that weren't as valuable, or that mounted "short-throw" so at least the thieves only damaged a £50 bracket rather than created a £1000 ceiling repair for their insurers.

ICANN't get no respect: Europe throws Whois privacy plan in the trash

Lee D Silver badge

It's simple. You trade with another country, you have to abide by their rules too for that trade.

It's a long-established situation everywhere, not just California. Otherwise Apple would just put two fingers up to every other state/country in the world and sell their products there. Instead they sold-out to China and all kinds of places to be able to sell their devices there.

You are "International" but can't trade with Europe? That's a 50% hit on your revenue immediately, not counting fines and compliance work that you'll still need to do anyway.

ICANN are being really idiotic here and will lose the EU domains if they're not careful. It wouldn't take a year to set up a "ECANN" and make all EU ISPs use it (you just say ICANN isn't GDPR compatible and, bam, they'll move over), which means that if the rest of the world want to trade with Europe, they'll have to send queries to ECANN not ICANN and the DNS roots will change to give preference to ECANN overnight (A third of them are in Europe anyway).

This is arguing with the legal system that binds 50% of your worldwide customers saying "We don't care, and we're incompetent enough that we can't even fix it", which will just end in loss of control, whether through incompetence or legal decree. And once EU goes, other nations will follow suit.

TalkTalk, UK2 sitting in a tree, not T-A-L-K-I-N-G: Hosting biz cut off after ISP broadband upgrade

Lee D Silver badge

They used to offer a lovely number for dialup with just uk2/uk2 as the login details, local rates.

Whatever happened to them? That was a great backup when the "new" DSL went down or just when you were "roaming" in a hotel or something pre-wireless.

And game servers, they used to run a ton of game servers.

Since DSL came along, haven't heard hide nor hair of them.

UK.gov: New London courthouse will focus on crimes of a cyber nature

Lee D Silver badge

Re: Will they fund the specialist lawyers and digital forensics experts?

Legal aid has always been a pittance.

Lawyers literally only work via legal aid out of the goodness of their hearts, or because their firm instructs them to, not for the pay.

The bigger difference has always been prosecution versus defence. Work on defending people who don't want to go to jail and you'll earn 10 times more than the people hired to gather the evidence to send you there.

Plus, courts are entirely separate to lawyers, forensics and everything else. The court is merely the venue when you show those items to people trained in law. They specifically AREN'T trained in every minor detail, that's for the lawyers to get across to the 12 lay-men in the jury and the judge who might not have a clue anywhere. Only incredibly specialist cases will dare mess with that.

If anything, you DO NOT WANT all that stuff in a court. You want an expert coming in, testifying, and being rebutted by other experts. You don't want judge and jury thinking they know more than the guy on trial, or the experts he's hired, or the counsel hired to represent him. Because, more often than not, they don't.

Take it from me, someone who works in IT, graduated in mathematics, was married to a barrister, and lived with a geneticist. In all those areas of specialism, I assure you I can point out huge gaping flaws in other people's expectations of what "hacking", "probability", "legal precedent", or "DNA match" actually means in real life. You want normal people listening to an expert who says "No, that's not how it works, your honour. There's only 96% certainty that this is the same DNA, which means that almost everyone in this room could be convicted of the crime being described today".

ZX Spectrum reboot firm boss delays director vote date again

Lee D Silver badge

What better way to flog a dead horse than to flog it thousands of times to other people and not actually give anyone any kind of horse, dead or not?

Apple is Mac-ing on enterprise: Plans strategic B2B alliance with HPE

Lee D Silver badge

Re: Actually...

Welcome to the 90's. It's where you appear to be stuck, anyway.

"Actually......it is easier to get an Mac to boot Linux than it is to get a PC to do the same."

Absolute nonsense. Stick disk in, F12, boot, install, done.

"They may have some ideas how they want to people to use their product but that is not different from how your dishwasher manufacturer want you to use their dishwasher."

My dishwasher has never told me that it only works with John Lewis Plates, that I'll need to use Apple Soap, nor that it "just can't do that" when I ask it for a 10 minute rinse instead of a 20.

"Most of the anti-apple mob are angry Windblows users who are afraid of losing their "supremacy" of having to reinstall their PC at least once a year."

1) If you're reinstalling a PC once a year, you're an idiot.

2) Would you like stats on how often I have to reinstall a Windows machine versus a Mac machine in a school with hundreds of the former and only a dozen of the later? I'll give you a clue: You lose.

"I am btw. running OpenSuSE on a MacBook Pro... installing Linux on a Lenovo was too time consuming."

Good for you. And why? As someone with an entirely-Lenovo shop, I can't imagine what could cause that. Literally, boot install at disk / decompression speed.

"Oh one more thing: Windblows still can't manage proper display scaling something OS X and Linux has been doing for over 10 years."

Display scaling? As in zooming your display to show on higher resolution screens? You really are operating in the dark ages.

London's top cop isn't expecting facial recog tech to result in 'lots of arrests'

Lee D Silver badge

But they're not.

That's a silly use case.

They're looking for possibly 100,000 people out of possibly 70m people. At that point - in fact, WAY before that point - the numbers explode and even an accurate system has an atrocious false positive error rate.

Lee D Silver badge

Just let them, already.

Because the tech most certainly is NOT ready.

And when it proves an expensive failure, it'll be harder to justify the next (or any) such system in the future.

I have not yet once managed to get through Stansted airport facial-recognition, with or without-glasses, wearing the same T-shirt as in my passport photo, etc. etc. Not once. I ALWAYS stand there like an idiot for 5 minutes while it keeps trying, and then get pulled away by the woman STATIONED at the damn thing to take people to the "Whoops it didn't work line" where a human does the job (and which is always a long queue, not just individuals).

This stuff doesn't work any better than random chance, and certainly not better than a trained human. Stop it. Or rather - trial it all, see how useless it is, realise the salesmen lied, get over it and spend your next pot of money elsewhere to avoid a repeat embarrassment.

A fine vintage: Wine has run Microsoft Solitaire on Linux for 25 years

Lee D Silver badge

"If I understood your problem correctly, the solution is simple:"

Yeah. Those obvious, intuitive commands, environment variables passing into other environment variables, etc. etc. etc.

I mean, I understand everything its doing and why. But I wouldn't be able to guess at that in a million years.

Who fancies a six-core, 128GB RAM, 8TB NVMe … laptop?

Lee D Silver badge

Re: What does it run?

People stopped dual-booting 20 years ago.

Having to shut down one OS to run another is ridiculous in the modern age, where you can run both simultaneously without issue.

Honestly, we stopped doing that the second virtualisation instructions were put into processors.

Lee D Silver badge

Re: What does it run?

That kind of machine, you're going to want VMWare or similar anyway.

That's a waste to use it for just one OS with those cores and RAM, when you can run everything at the same time.

Linux as the base OS, maybe, but good luck getting all the drivers (especially for the RAID etc.).

New Android P beta is 'very close', 'near-final' but also just 'early'

Lee D Silver badge

Re: What's the app?

To my knowledge, an awful lot of phones have never supported recording calls at all, but that's a hardware manufacturer integration. If they don't present the hardware to the Android drivers, then there's no way for the Android API to record it.

But also note:

https://developer.android.com/reference/android/media/MediaRecorder.AudioSource

"This permission is reserved for use by system components and is not available to third-party applications."

Even the latest Android APIs do have an option to do just what you're talking about, but it's never been properly exposed and officially supported. When you use unsupported stuff, that's what happens.

I don't think it's ANYTHING to do with Android. It's to do with people BYPASSING Android. And I think it's to do with manufacturer's not exposing functionality in a standardised way via the Android APIs that already exist and/or not producing hardware that supports such functionality (e.g. a voice-call-handling chip that doesn't provide the voice data to the processor running Android at all).

Lee D Silver badge

Re: Wonder what it'll break ?

What's the app?

What's the function that can't be reintroduced?

Is there a single other app anywhere in the Play Store that does the same function (I don't care how, what else, whether it's prettier)?

Because I imagine there's not much that doesn't work in the way you state, when the developer is non-lazy.

Lee D Silver badge

You mean the OS where you're not allowed to render a website in any other way than an Apple control.

Google Chrome on iPad / iPhone is just a Safari control in a different coloured box.

I'm not at all sure that "universality" of APIs is an no-questions-asked good thing in and of itself. There has to be something else too in order to ensure you can program against them freely.

Also note, it's impossible to do certain things on iOS programmatically at all, by design. Sure, that saves you a few small security headaches but the amount they MISS tells you that that isn't the end of the story either. And causes huge user interface problems.

Don't even get me started on the junk that is screen-modal pop-up login dialogs that don't tell the user their origin, and go over the top of anything you happened to be doing.

The Notch contagion is spreading slower than phone experts thought

Lee D Silver badge

Because it's pointless, that's why.

HMRC told AGAIN to toughen up on VAT-dodging online traders

Lee D Silver badge

Re: How hard can it be?

Why?

If they have to mark all their products as "used" to be VAT-free, then they're not going to like doing that for big-brand items (i.e. the things that sell for the most money).