Posts by Dodgy Geezer

It is interesting to consider...

...WHY this proposal was made by GCHQ.

It all harks back to the reason that we have 'state security' bodies in the first place. Why don't we just have police forces, who can be just as suitably equipped and staffed? The answer is that the Security Services and the interception networks that they use were designed to operate OUTSIDE the law.

These bodies were set up during wartime - WW1 and later WW2. In those conditions, where a spy might be directing an invasion, there was neither the time nor the desire to go through the process of obtaining a warrant for every action. People could be arrested and retained without charge for an indefinite period. People's mail could be diverted or opened at will. If due legal process had to be followed, there was the risk of warning the suspect, or losing valuable time.

This culture survived after WW2 into the Cold War. And so long as it was only 'Russian spies' that these powers were being used against, no one cared too much about the fact that legal principles were routinely dispensed with.

Now the Security Services have run out of the traditional justification for their jobs, and are trying to maintain their staff and budgets by moving into straight criminal activity - the kind of thing the police ought to be doing. But they are still maintaining their 'Cold War' culture. Note that they often don't want to offer evidence 'for fear of revealing sources and techniques'. That is a WW2 justification. They operated widespread communications interception - a WW2 tactic, and had to have it retrospectively legalised when it was discovered.

One of the lesser-known laws during WW2 was one which stated that ANY invention could be impounded by the military and suppressed or used without compensation if that were deemed necessary to the war effort. Again, a rule which makes sense in wartime. But now I see it is being revived by the Security Authorities in peacetime - 60 years after WW2 and 30 years after the Cold War ended...

I don't think I've ever seen...

...a big blue-chip IT disaster where so LITTLE technical detail has leaked out to the Register.

Of course, employing people who only speak Hindi probably helps...

This has been said many times before...

...Advice on safe internet use is "horrible", he added. Telling users not to click on phishing links and to download strange executables effectively shifts blame to them and away from those who manufactured hardware and software that is not secure enough to be used online.

"We are giving people systems that are not safe for the internet and we are blaming the user."...

The misunderstanding here is that people expect 'security' to be 100%.

It can't be. It's a continuous process. At any one time there are threats and defences appropriate to that period. AV scanners are actually still quite useful, but if they become less useful and people go for white-lists, then the black hats will attack white-list technology. If we go for physical defences then they will examine how to overcome these (usually by social engineering).

There will ALWAYS be SOME level of risk attached to doing anything - or, indeed, not doing anything, and computing is no exception. Adequate security involves knowing something about what you have to protect, knowing something about the risks, and taking appropriate levels of precaution - which will almost always involve some defensive measures, some impact-minimising measures and some recovery measures.

Trying to get people to realise this, rather than asking for the best product to provide total protection, is a major job for security professionals...

Not far enough

...Thoughtful security by design would go a long way....

...but not far enough.

If something is insecure - say, uses default password '1234' - it's fairly easy for any malicious user to hack you

If something is secure by design, that needs a deep investigation by skilled hackers to find a vulnerability. There will always be several in complex system - it's just a question of how hard it is to find them. That sounds good. The bar has been raised. Only a few highly-skilled hackers can possibly attack you....

But.... the skilled hackers write their attack routine into a script. And publish it on the Web. And now it's fairly easy for any malicious user to hack you again....

Do you remember...

....when the government had the Central Computer and Telecommunications Agency (CCTA) to oversee big projects and provide world-class expertise when needed?

Government IT projects didn't fail then.

But then the Government closed CCTA down in the 1990s, because the industry said they could do a better job on their own...

...The quality of the professional news outlets varies greatly, but anyone with a little experience will know which publications are more likely to produce unbiased news.....

Er....NONE of them...?

Chickens home to roost

The government used to have an agency called the Central Computer and Telecommunications Agency (CCTA)

That ran government procurements, and never had a failed project.

It was closed down in the 1990s as Thatcherite politics required industry to do this sort of job. And the rest is history....

Right wing views...?

...no subsidies for renewable energy...

That sounds just like common sense...

Not going to happen...

... Brexit will leave some of those tens of billions looking for a new target. ...

Brexit won't happen. Even if there is an 80% vote in favour.

The Governing group in Parliament make the rules, not referendums. And until there is a pro-leave government party, we can whistle for getting out of the EU.

I'll bet they don't mention Skylon...