Posts by Hargrove

Re: With great power comes great responsibility...

Bravo!

Firefox has worked well for me.

Related to that, prioritization by monetization is beginning to break down.

I am finding that the crap-to-worth ratio of Google Search has reached the point where for most of what I search for DuckDuckGo is better.

Re: Ah, Access

Ah. Yes. I remember it well; well vaguely. I'm older than some of the dirt in my garden. . .composting being another gift that keeps on giving.

I remember Access as the proximate cause of losing one of my best employees. He was an undergraduate IT intern at the time, exceptionally bright, and fluent in English, Japanese, and German.

We had a contract that specified a database deliverable in Access that he was assigned to work on.

The data base was largely comprised of blocks of text. I don't recall the details, but the functionality required that sometimes the data element needed to be handled as a variable, and sometime as the literal text string. (Apologies. I'm not sure that "string variables" are even a term in use anymore. At this point I had already gone from being an engineer to being a system engineer--a function for which customers were willing to pay handsomely despite it being, as we used to say back on the farm, "as useless as tits on a boar hog.)

The bottom line was that the coding didn't always work as described in the documentation. As deadlines neared, angst increased, and he appealed to me for help.

I believe I mentioned I was older than dirt? Twenty years of programming, one develops an intuitive feel for things. I hadn't been a system engineer that long at this point, and some real skills were still in the memory bank.

The short version is that under some conditions, some functions would work with the data element variable name; others required the literal string enclosed in quotation marks. It appeared that the program at times performed manipulations that converted from literal string to a variable name, such that in some cases, the documentation showed literal strings enclosed in two sets of quotations.

Being old school, I did the trial and error thing, eventually generating a matrix of the diverse functions, and where, when, and how many sets of quotations the data base software required and did block search and replace on the code. (If aging memory is correct, four or five was the max I needed to get a function to actually work.)

The intern demanded to know "how did you know that would work?" He was not satisfied with a shrug.

Unfortunately, by the 1990's IT professionals were already fully indoctrinated fundamentalists, with unshakeable faith in the inerrant infallibility of "the system." It was apparent that he was firmly convinced that I was withholding information and was just messing with him by telling him that I didn't--that it was just trial and error.

We made him an offer for full time employment when he graduated, at a rate that left no profit margin on our negotiated contract rate. A local government laboratory offered him $5K more per year plus a 5K bonus before graduation, so maybe his Access Angst wasn't the problem.

Re: backup your cloud storage

There is a practical issue with redundant cloud storage as a solution, from a system standpoint.

The 'net is an integrated end-to-end system comprising the sum of connected users, hardware, software, and information connected at any given instant. Its size, configuration and complexity, and functional state change continuously at intervals measured in nanoseconds. It is intrinsically indeterminate and interminable.

The system is unbounded. But it is not infinite. Its performance, although incomprehensibly vast, is finite. And it is often limited by local subsystem performance, the unintended consequences of which can have catastrophic effects over large parts of the overall system.

Such a system cannot be reliably operated or maintained. The constant string of reports and the discussion in El Reg are concrete evidence of that.

A brief excursion into reality to support my assertions. From an end user perspective the system has no specifications. Not many years ago IT users demanded and equipment and service providers guaranteed to deliver a minimum level of performance with a specified reliability. Rliability was commonly expressed in terms of "availability" (basically the percentage of the time that the system was guaranteed to work as specified over a given period, typically a year) and contracts provided for adjustment in cost for if they couldn't restore service in a timely manner to meet the threshold.

In this era 99% was considered poor, four 9's (99.99%) was considered reasonably achievable.

From my narrow perspective, this all changed around 2010, as federally-mandated initiatives for automatic security patches and updates and cloud computing were implemented. I saw the specified system availability in an annually-renewed service level agreement for a web hosting service I was involved with go from 99% to 90% and then disappear completely.

This was NOT due to any lack of diligence, competence, or desire on the part of the service provider. The simple fact is that dependence on third party software and services, and the unintended consequences of continuing patching and updates from a myriad of software vendors and third party service providers make it impossible to guarantee anything.

The Achilles heel of the system is bandwidth. Marketing hype notwithstanding "unlimited data" and its more egregious step-sister "infinite bandwidth" are myths. They are exercises in metaphysics, valid only with the presumption that we have all eternity to download our data.

For a few individual with a few tens of gigabytes of data, who need to retrieve specific files, redundant cloud storage and local back up may be a practical solution at the moment. On any kind of scale, however, the bandwidth simply isn't there. We are already seeing this in the massive marketing push to get users to accept "unlimited data" plans, advertising "speeds up to" under terms and conditions that do not actually guarantee ANY level of performance.

This is not going to end well for anyone.

Re: Try the LTSB...

@Dan 55

That would be the same Cortana and Edge that MS told W10 users were integral to the OS and could not be removed or disabled? The LTSB is nothing more or less than a tacit admission of failure, one by some accounts forced on MS for the Chinese version.

We live in interesting times.

Re: Foveated rendering is not a magic bullet

@Clive Galway

Did you mean non-foveated in the third paragraph?

Re: Huh?

@khentiamentiu

BRAVO!

Words and what they mean matter. At one time dictionaries were among my favorite reading material, Now. . . Well to quote Humpty Dumpty in Through the Looking Glass, "Glory!" (which he defines as "There's a good knock-down drag out argument for you" when Alice challenges him.).

We live in a post-truth Looking Glass world where, to paraphrase Humpty, words mean whatever the person using them intends them to mean.

Unfortunately, even dictionaries have become corrupted. They are dealing this by simply discarding long standing wording of definitions in favor of the moral equivalent of self-licking ice cream cones, to wit (to offer my own modest neologism):

serverless -- not having or appearing not to have servers

By tolerating this kind of insanity we are all complicit in the continuing degradation of the defining characteristic of humankind--symbolic language and our ability to communicate. We are effectively destroying our ability to relate to one another as human.

This will not end well for us.

Terrence Deacon in his book "The Symbolic Species" introduces Hoover, the world's first and only talking seal. Maybe, if Hoover's lucky enough to find a mate with the right DNA, the seals will do better.

Re: Bollocks...

“exponential intelligence fueled by pervasive technologies”

Apologies for lack of originality here, but kudos to @ForthisNotDead for having taken the only apt title for a post on this article.

I once worked on a project whose proponents promised to eliminate the need for expensive subject matter experts by collecting all the technical data available in an electronic shoe box and using a semantic query to retrieve "the best answer to any technical question within seconds."

The goal was to eliminate the need to spend about 3 million dollars a year to support committees of subject matter experts. The cost of saving the 3 million was estimated at 40 million/year. The fact that no one in the USG saw anything funny about the math explains a lot about the US deficit. (OK, in fairness, the proponents did postulate that once built the system would be used for lots of other things justifying the investment.)

The problem is that at the end of the day, such a system cannot deliver as promised, even theoretically. Tom Fawcett's paper on the subject presents a concise and readily understandable explanation.

http://www.hpl.hp.com/techreports/2003/HPL-2003-4.pdf

Re: TOld is when you remember the invention of the 8" floppy

Hollerith cards, anyone?

Re: "this is a very poorly researched and stated article"

@Pascal Monett:

D'accord, Pascal. This article addresses some realities that need more rather than less visibility.

In addition to being on the desk of every pointed-headed boss, it should be required reading for information systems designers and customers. Faith in the cloud is based on unshakeable belief in myths of infinite bandwidth and "solid state reliability", neither of which are true.

El Reg is distinguished for discussion of real technical issues that are generally simply ignored, not only by the general public, but by professionals who should know better.

An arms race they will not win.

@Martin Summers

Absolutely on the mark. The internetworked system we all depend on was not designed for the current cyberthreat environment. In reality, as a system, it was not designed at all, but grown like Topsy to maximize return on investment. The fact that we all -- IT providers and customers alike --share in the benefits of that return doesn't change the harsh reality,

Such a system is not secure. It is inherently un-securable.

Security as a cloud computing service is not a solution, because of another harsh reality. The predominant threat to theft and expoitation, is now, and ever shall be, the insider threat.

I believe that there are technical solutions to be had for a price. User devices will cost more and be marginally less convenient to use. IT providers are going to have to forego the business model of reselling hoovered data with no value added. It will not be cheap, but it will be a lot cheaper than the alternative.

Re: As for the 'Cloud'

You're dealing with the tobacco industry equivalent in IT who will bribe, bully and sue its way to profit with complete disregard for anything else. And I mean *anything*.

Spot on. And when it comes to the cloud, "anything" includes that hoary elephant in the parlor called "bandwidth." Thanks to growing ignorance of the basics of mathematics and logic the myths of "Infinite Bandwidth" and "Unlimited Bandwidth" are alive and well. But the marketing smoke and mirrors only obscure an ugly reality.

We don't have the bandwidth to sustain the current design paradigm, even in theory.

Re: Correlation is not causation

We can confidently expect more of this as the number of bits of active code running, on "the system" continues to grow exponentially. Microsoft's plan to hoover apps and data has the appearance of a last ditch effort to cure the incurable. Some years ago, in an effort to sell the notion that "information superiority" would so awe a numerically superior enemy that that they would surrender without a shot, the US Department of Defense came up with the catch-phrase, "The network is the system."

The US have since learned and adapted to the reality that it is the nature of cornered animals, including us, to bite. But the slogan had it right.

The network is the system. And anything attached to it, including our new toaster oven, is part of it. The size and configuration of this system is indeterminate, and--as a practical matter--indeterminable.

Every device, every component, every bit of code, and every user, human or automaton, is part of a vast, complex, dynamic, non-linear system.

"But wait," the IT geeks cry, "it's DIGITAL; that's not non-linear."

But it is. Network queueing theory tells us so. As does the fact that my Windows workstation regularly spikes to 100% Disc Usage, for no single discernible reason that anyone has been able to pin down that I'm aware of. Something to do with Skype, Chrome, your disc driver. . . (Then there all those ROHM'd transistors merrily sprouting tin whiskers.)

The responses are all quintessentially non-linear.

The history of computing, from Jacquard's one operation/second loom in 1806 to today's petaFLOP computers internetworked with literally millions of computational devices capable of giga- and teraFLOPs leads us to believe that there are no limits.

It ain't necessarily so. The network is the system. Everyone hooked to it--including the connected cyberterrorist--are insiders.

My perspective is admittedly biased by fond memories of programming computers the size of refrigerators by punching binary indicator light/switches on the font panel. Between then and now I've seen inconceivable changes. The problem is that those changes have evolved at inconceivable rates, with results that were unimaginable when the critical design decisions were being made. Those include radical changes to the "cyber-ecology" in which the internetworked system lives.

All my experiences and observations persuade me that the flaws and failures reported in el Reg are symptoms of a more serious, potentially catastrophic condition. At this point, "Security First!" is just a marketing slogan. The IT community needs to give serious consideration to the possibility that the current design is not equipped to survive in the environment it created.

We need to go back to first principles and ask what a system designed for security first in today's (and tomorrow's) cyber-ecology needs to look like. I suspect the answer will not look anything like what we have.

Re: @ ShaolinTurbo

Policies written by companies do not trump national laws, see Apple and Apple care in Europe.

The problem is that lawyers are, all too often, unprincipled, sociopathic bastards, and, at least in the US in some cases the legislators and judges who craft and interpret the law.

We here in the US are up to our proverbials with service and sales agreements whose terms and conditions require the customer to waive all manner of basic rights. Where information is concerned the T&C of the agreement generally incorporate the privacy policy by reference.

The Agreement is a legal document, whose sanctity is protected by the best laws money can buy. (See first paragraph.). Whether or not it is a legally-binding document is a complex question.

I am not a lawyer (although I've been accused of being fully qualified--Again, see para 1.). But in my checkered career I did get a fair amount of formal training in contracting. According to what I was taught, a valid legal contract must meet three essential requirements: A balanced quid-pro-quo (both parties receive comparable value), a meeting of the minds (that is a common understanding of the terms and conditions of the contract, and an uncoerced agreement (that is the stronger party cannot compel the weaker party to accept unfavorable T&Cs against their will.)

I am personally skeptical that anything like a valid contract can exist between an individual or small business and a large corporation or a government, particularly when it comes to something as complicated as Software as a Service. Fortunately, at least in the US we have very clear de facto rules as to when such agreements are considered legally enforceable.

1. Are you the IT provider? If yes, the Agreement is a contract and any and all rights claimed or asserted are protected by the full power of government.

2. If no, are the customer? If yes, you can seek justice in the court, which will confirm that you are in a legal state of WTTF (Well and truly f---ed) that is to say, powerless, bankrupt, homeless, and with a rich lawyer who will refuse to return your calls

The IT sector is not alone. This problem is pervasive in virtually all aspects of American life. The frustration of being powerless drove the election of President Trump, with the unspoken hope of breaking the government so badly that it would have to be fixed. So far, so good.

Andthereinliestherub

Whilst I wouldn't expect Joe Average to be able to recover it, ANY even semi-capable IT outfit who CHARGES should be able to reinstall previous Windows version, the old user profiles and if necessary pertinent registry data.

PC are basically commodity consumer products. The fact that keeping them functioning demands the services of a paid professional IT staff IS the problem. Moreover, getting a professional fix is not guarantee that the system will stay fixed--as anyone who has tried to find answers from the Microsoft Community has probably observed. (One of the prime examples is the 100% Disc Usage issue, One of the more amusing aspects of that is that so-called "experts" routinely blame Skype and Chrome for the problem, with splendid disregard for the fact that Skype and Chrome are not installed on a given user system.)

It appears that this particular problem can be generated in a number of different ways. With continual updates (not necessarily MS's) fixes fail.

IT providers and users alike have lost sight of something fundamental. The network--INCLUDING THE USERS' DEVICES--is the system. Its configuration and state at any given instant is effectively indeterminate and indeterminable. Such a system in intrinsically un-secure and un-securable.

As witness El Reg Article Dishwasher has directory traversal bug.

Re: Hide extensions for known file types

I admit to being old and slow. Old enough to remember editing programs on the fly by punching in binary code on indicator/switches on the front panel of something the size of a (large) refrigerator.

I appreciate that technology has changed. But, somethings should be fundamental. Like words should have meaning. Words like "Operating System."

Classically, an operating system comprises the basic functions for managing the hardware resources required to store and retrieve data, and allow software to execute the instructions of the CPU.

Explosive advances in hardware complexity and performance created a need for a hardware extraction layer. And things began to grow like Topsy, with applications being acquired and tacked on to "operating systems" like so many layers of barnacles. The resulting conglomeration requires constant patching and updates of Gbytes of code. The result is an internetworked global computing system--whose functional elements by the way include me and my computer, and billions of other users and devices. The configuration and functions at any level are unknown, and unknowable.

Back in the day, if someone had described this I would have argued that such a system design was inherently insecure and un-securable, and that any expectation to the contrary was insanity.

That's one thing that has not changed.

BRAVO!

Just ask a professional. It’s the person who doesn’t use the word ‘cyber’ to prefix everything they say.

Truly insightful comment. Of course it eliminates virtually anyone working in, for, or around the US government, beginning first and foremost with the idiots in Congress who stepped in it by deciding that the answer was to legislate that things be secure. This in turned spawned an entire industry operating on the premise that certification is better than competence, and that by collecting enough data, in enough different data bases, big data analytics will magically optimize the government's IT infrastructure and achieve cybersecurity.

Coincidentally, I ran into a friend yesterday who has recently gotten into the cybersecurity business. He had been in the anti-tamper business. The name means what it implies, and includes various methods of preventing exploitation of classified hardware/software resources by physical destruction. This obviously a narrow and specialized market, most consumers objecting as they do to things bursting into flames. It is, however, a handy feature for military operations.

He told me that anti-tamper was now part of cybersecurity. I asked him, "And, how long did it take you to find out that this was simply a ploy to transfer your funding to a bunch of IT contractors who don't actually do anything."

He gave me a funny look, and said, "We got a 14 million dollar program. The budget for anti-tamper work was zeroed out."

Similarly, requirements for information assurance--ensuring the quality of service, reliability, and, yes, security, necessary to provide the right information for real-time command and control--were subsumed under "cybersecurity." These are attributes of a system where the physical layer matters, and where we face daunting challenges that are largely being ignored, by a generation of technological nitwits who talk about "unlimited" (some use the term "infinite") bandwidth as though it were something real.

My impression is that cybersecurity is simply another cash cow for special interests who have found a source of revenue exempt from the onerous burden of having to meet hard performance specifications. A field where perception is reality, and anything that can be asserted, however idiotic, is as good as the truth.

From that perspective, Giuliani's appointment makes perfect sense.

Re: ECHR

An excellent observation. . .

Just because you're paranoid doesn't mean the men in the dark suits getting out of the sedan at the curb haven't come to see you.

Re: Amused to Death

SPLENDID! Just splendid. Sincere compliments.

For precision:

Half the UK is below the median IQ for the UK. I've read that globally, the "average" IQ has been steadily declining, and is now below the established "average." I blame technology for short circuiting natural selection.

The UK are not alone. The Brexit phenomenon is in play in the US, chez les Trump supporters. Hopefully Brexit will be a wake-up call for the US and the electorate will realize that "Holy ----! We could wind up with the village idiot as President."

Re: Often modelling simply adds rigour to thought experiments

@ MHF WIlkenson:

Re: The problems with floating point inaccuracies coupled to chaotic behaviour is well-known to any scientist worthy of using HPC systems for numerical simulation (and, yes, there are many that aren't worthy).

Amen, amen, and again, I say amen. Nearly 20 years ago now I read an article in which the Dassault folks, who knew a thing or two about advanced combat aircraft design, had some cogent comments of the amount of testing needed to verify that the granularity of discrete simulations was adequate. This last paragraph is one of the clearest and most concise summaries I've seen on the subject.

Re: So THAT is why the summers aren't as good as when I was a boy!

maybe new legislation "Down With Things Like That! (2016)"

Your suggestion may be tad late. Faced with amorphous and diffuse global terrorist and cybersecurity threats, legislative bodies in the US and EU are opting increasingly for legislation that empowers those who govern to interpret the law case-by base on a "We know bad when we see it" basis.

Always implied, and often stated is the tag line, "You can trust your government."

That has never worked out well for those who buy into it.

We live in interesting times, and advancing technology and geopolitical change may ultimately force societies to accept that governments need this kind of flexibility to protect their citizens. We can have a free society only if such powers are constrained by laws imposing the most draconian penalties for their abuse. Unfortunately, most of us live in countries whose codes of laws have been carefully crafted to protect those who govern from the consequences of their official actions,

We have decades and miles to go.

Re: Listing the people running such companies

Re: Adrian Midgley 1

and if the journalist time is available digging and following them would be a service to society.

. . . and speaking of digging, if one had a backhoe handy, one could do an even greater service to humanity. Consider the benefit to the quality of the human gene pool that could be realized.

Re: Interesting list..

That may be an artifact of those countries not being on the list of countries to whom exports were authorized on the license in question. The wording implies that they might not have been, which would account for why they don't show on the list.

In this case (although the article is not particularly clear on this) my guess is that the specific incident cited constituted a violation of the terms and conditions of the Italian license. Best guess, looking at the article is that the Boeing project was deemed to be a military end-use not permitted on a civil export license. The reason that the company can still "export" to other EU countries probably has to do with other laws and agreements regarding trade and cooperation within the EU.

If my guess is wrong, and exports are still allowed to the countries in Mark85's post, this is, indeed, a very interesting list.

Re: I'm skeptical

Kudos to the originator for an interesting discussion topic, and to Sebastian--us skeptics need to stick together. .

Two quotes come to mind: The first is from Paul's Epistle to the Corinthians. "Everything is permissible for me; but not all things are helpful."

The second was a Navy admiral's response to a sales pitch for newer technology: "S--t son, we don't know how to use the technology we've already got."

Forty years ago, my work gave me a chance to see some remarkable--and economically practical--3D display capabilities demonstrated. For one reason or another, they never caught on.

The devil is in the details. Human visual perception and cognition have been evolving to deal with the physical world for hundreds of thousands of years. We have not yet begun to scratch the surface on how the human intellect deals with the ever-increasing stimulation and information flow we have to deal with.

My observation at this point is not very well..

From an engineering standpoint, our understanding of the internal physiological and psychological mechanisms is still pretty primitive. VR designs, of necessity, reflect the designer's assumptions based on those understandings.

Add to this the fact that our understanding of the economics of the market is no better shape, and uncertainty abounds. But it is fascinating stuff.

@allthecoolshortnamesweretaken

So that explains how they came up with "resilient practice leader."

The critical question is whether our "resilient practice leader" (RPL) has been certified as a Certified RPL (CRPL) by an accredited certification authority (ACA) who is a designated appropriate authority for accrediting accredited RPL certification authorities. (DAAAARPLCA). (CRPL status requires completion of a rigorous on-line course, involving an hour of study, a multiple choice test and payment of a fee of several thousand dollars to the on-line training provider contributing the largest amount to selected Political action Committees (PACS))

At least this is the way cybersecurity appears to work in the US.

Not very would be a good guess

@ Anonymous South African Coward

A couple of weeks ago I posted the following on in the Forums. I found Goodman's book an interesting an interesting read on the subject.

http://forums.theregister.co.uk/forum/1/2016/03/15/Hargrove_Anyone_for_a_Book_Discussion_Marc_Goodman_Future_Crimes/?post_received=2826108#c_2826108

Frankly I see no way that the users of IT can defend themselves against the growing malware threat in the current operating environment. That is:

Software suppliers who require that users accept downloads of countless thousands of lines of executable code whose only purpose is to provide economic and competitive advantage to the vendor. This is code that runs in the background, that cannot be easily removed by the average user, In many cases, unwanted functions are bundled with essential functions in such a way as to preclude their removal. The user can disable them. But again, in many cases, this only disables the user interface. The programs stay on the system, and run in the background doing God knows what. . . I as the owner of the system in question certainly do not. And the vendors do everything in their power to ensure that I as the owner/customer do not have easy access to that knowledge.

Fundamentally, each and every one of these unwanted components is a potential vector for malware.

Those who govern, particularly here in US have been fully complicit in creating this operating environment. The practices and policies established under the veil of the Federal Information Security Management Act has been key contributor, as have the restrictions on and impediments to use and development of effective cybersecurity technologies.

It's been 45 years since I had the IT chops to program in machine language by poking the individual indicator light/switches on the from panel of a Navy tactical computer. But I fancy I still have a feel for the territory. I was edified to see that other commenters--who are clearly more knowledgeable on current technology than I am--had some of the same questions about this threat.

If those who sell and govern gave a rat's ass about the security of their customers, the answers would be universally available. As it is end-users are forced to rely on crowd-sourced Communities, half of whom appear to be shills for the company, parroting back steps that don't work, the other half of whom are guessing--usually that something that didn't work for W7 might work for W10, It is to weep.

A side note. Downloading W10 opened a Pandora's box on unanticipated complications for me. Will spare the details, but in the process, I wound up contacting customer support for my router. The tech expressed great surprise when he couldn't access the router remotely, with the default "password."

Effective security is impossible under these conditions.