* Posts by Vimes

1319 publicly visible posts • joined 3 Dec 2012

IWF shares 'hash list' with web giants to flush out child sex abuse images online

Vimes

Isn't MD5 subject to certain issues? The term 'collision attack' comes to mind where two values can produce the same hash. Presumably this sort of weakness means that it's possible for innocent images to be caught up in the dragnet.

And as for anything to do with capabilities provided by 3rd parties, will those 3rd parties be accepting responsibility for any false positives or negatives found as a result of using their systems? Will those using said systems face any consequences if/when problems occur?

Or (as I would personally expect) will everybody get off scot-free, and all because it's 'for the children'?

Jail incompetent council folk who leak our data, thunders furious BBW

Vimes

“Current penalties for serious data breaches do not deter individuals who are seriously considering breaking the law,”

Employees of a data controller can't normally contravene the DPA unless it's a section 55 offense related to illegally obtaining personal info.

http://www.legislation.gov.uk/ukpga/1998/29/section/55

Who should be charged and on what legal basis should they be dragged into court?

Samsung refuse warranty service on Note 3

Vimes

Re: 3 alternative options

1) Visit one of Samsung's high street stores. Get one of their sales staff to use their internal contacts.

That assumes they'll want to help. If it's anything like the 3 or other phone stores I've visited in the past, then they'll do their level best to avoid doing anything that doesn't involve selling you something.

2) Carphone Warehouse.

After the hack? Really? When they won't even tell people how far back the compromised data goes or accept that relying on stored email addresses to contact people isn't enough when they might have changed?

Vimes

I asked Samsung whether it was normal practice to ignore customer complaints. Their only response - understandable I suppose - was to ask if I had a reference number. (I suppose they assumed I was the one that had made the complaint).

Oh well...

Vimes

I'd suggest sending email to the CEO (possibly using a temporary hotmail account set up for that in order to avoid any spam listing). But then this is just suggesting the obvious...

The only other thing I have to add is that providers seem to be abandoning their phones more quickly these days. Even a number of years ago this was happening with other companies like HTC and their HTC Desire model - after about a year it wasn't being supported any more. From Samsung's point of view the Note 3 is no longer the flagship phone - the Note 4 has taken that place.

Not that any of that excuses the responses of them that could easily be considered rude, but it might explain things at least since they appear to no longer consider it a handset worth supporting (at least if the responses you received are anything to go by).

In any case it might be worth avoiding them in future, especially since there are already rumours that the S7 might be released earlier than originally planned - this sort of planned obsolescence is only going to get worse for them if they increase the rate at which they release them.

Come to think of it: if it's a Note 3 then presumably it was bought within the last 2 years? Legally all such items bought within the EU have to have at least a 2 year warranty period (again IANAL). It might be worth threatening them with reporting them to Trading Standards since they would appear to have an obligation to either fix or replace it.

Vimes

I would have felt less offended about it all if they'd even offered a loan handset, for the time it was to be away, but they didn't.

IIRC there's a plugin for Skype called Pamela that allows you to record the call.

One possible reaction would be to use it. Give them one last chance by calling them. Record said call, give them a liberal amount of rope to hang themselves with and if - as will probably happen - you don't get what you want you can include the entire conversation with them as an attachment in the email to the CEO (plus you can also use it to publicly shame them on Twitter if you're so inclined).

Of course doing that without telling them that the call has been recorded might be legally dubious. IANAL, so be careful.

I mean, that must be the easiest and most common repair ever, surely?

Not necessarily. If memory serves shortages in screens has been an issue over recent years, so it would only be an easy repair in the sense that it would be in the terms of the process of swapping the broken one with the new one, not the process of obtaining the new one in the first place.

Vimes

Then surely it's their responsibility to replace it with a similar device - I.e. a note 4?

(If you mange to put off any replacement for a few weeks you might even manage to get a Note 5 since it's due out soon)

As for the CEOs email address:

http://www.ceoemail.com/s.php?id=9203

Want to download free AV software? Don't have a Muslim name

Vimes

Re: so now tha bad guys

What gets me is that providers are continually allowing themselves off the hook with the excuse 'not our fault guv' (much as ISPs do with the internet filtering whenever anything goes tits up there too).

Enough of that bullshit. The service providers *chose* to use these lists, and they should be made to answer for any mistakes that result from that choice.

Perhaps if that happened they would be putting more awkward questions to the list providers before using their products and these frequent 'false positives' - which in turn suggest sloppiness on the part of those providing the lists - might happen less frequently.

Microsoft vacates moral high ground for the data slurpers' cesspit

Vimes

Instructions on how to increase privacy in Windows 10

https://fix10.isleaked.com/

Junior defence staffer on trial for 'posting secret dossier to 4chan'

Vimes

After what happened with Bradley (Chelsea?) Manning & especially Snowden why on earth did he have the opportunity to burn sensitive material to a CD in the first place?

It's interesting to see how the authorities never want us to think about how they managed to cock things up too.

Amazon is spamming customers...

Vimes

Great: now I've got a certain Blackadder episode stuck in my head, since even within the same language there can be problems (even more so when people want it).

My most enthusiastic contrafribularities.for having made such an excellent suggestion by the way. I hope I didn't confuse there - I'd be anispeptic, frasmotic, even compunctuous to have caused you such pericombobulation. :)

Vimes

Re: Amazon is spamming customers...

The complaint has already been sent, although I have yet to receive any confirmation.

Another thought: how can any data protection regime be run acceptably when it involves shifting responsibility from one country to another? How many languages are there in the EU, and how viable is it to have a system where those making the complaints might well not be understood by those receiving them?

Vimes

Re: Amazon is spamming customers...

Yep. And because my main email address is different to any of the aliases used for the accounts their only question boiled down to 'give us your email address first', which suggests to me that they just want to specifically stop sending me the spam rather than stop sending any spam in the first place. No explanation of this apparent abuse of the soft opt-in rule.

Vimes

Re: Amazon is spamming customers...

Well if more people refused to use them, as I have done ever since the "one-click" patent stupidity, they wouldn't be in a position to conduct themselves in such a way.

Another thought: some of the addresses being spammed are those associated with my Audible & Lovefilm accounts. Both of which have since been bought out by Amazon (and in the case of Lovefilm since renamed).

You can try and avoid them but even then they can still end up with your details...

Vimes

Re: Amazon is spamming customers...

It might also be worth noting that all other emails I get from Amazon are clearly linked to my usage of their services given the contents of said emails.

I would be happy with those links because unless Amazon itself has been hacked then the chances of other people randomly guessing what I've been looking for is sufficiently low to not worry about it.

Vimes

Re: Amazon is spamming customers...

But if you DO purchase from them, I don't see why, on a technical level, you would be reluctant to click througb a link in an email that originated from them.

Because we can't be absolutely certain the link is valid or that the email is in fact from them (although they don't seem to have disputed it so far). Remember that such emails are unsolicited.

https://en.wikipedia.org/wiki/IDN_homograph_attack

Vimes

Re: Amazon is spamming customers...

That would be option 'b'.

Personally speaking I would see no reason why I should have to unsubscribe from lists that were never subscribed to in the first place. If I see emails I don't expect to see then the last thing I will be doing is clicking on any links.

Amazon of all people should not be encouraging the wrong sort of behaviour.

The ICOs reaction to it is a little worrying too.

PECR != DPA, and their attempt at confusing the two is not exactly very comforting.

Vimes

Amazon is spamming customers...

...and ICO says it's powerless to intervene.

https://patrick.seurre.com/?p=316

As others have noted elsewhere, it's an interesting leap from PECR to the DPA, and may not properly address the question of terratorial jurisdiction.

Antitrust this! EU Commish goes after HOLLYWOOD’s big guns

Vimes

many arguing that it protects minority language European films from Hollywood competition

How does turning away people wanting to hand over money protect smaller companies from Hollywood?

It's not just within the EU that geo-blocking is an issue either. Personally I'd still like an explanation as to why British programs like Midsomer Murders & Poirot amongst others are available in the US on netflix but not the UK. In some cases BBC programs also ended up available in the US first too.

NSPCC: Two nonces nailed by cops every day

Vimes

Re: Lies, statistics and people who just can't count

which implies that rate hasn't changed

Not necessarily. It could just indicate they think the number of child abuse cases is too high even now even though there might be a downward trend (obviously in this context anything more than zero is too much). A way perhaps of emphasising there is more to do.

Vimes

Re: Lies, statistics and people who just can't count

Playing the part of the pedant for a moment... from the NSPCC page:

Sex offenders are still being convicted at the rate of 2 a day for possessing child abuse images 2 years after the Prime Minister urged industries to ‘obliterate’ them.

Nothing in that suggests that their study covers the entire 2 year period.

'a rate of 2 a day' could still hold true if the length of the snapshot was 50 days. They never say that their sample covers the entire 2 year period, just what the current rate is during the period of their study, which happens to have been conducted two years after Cameron's statement.

As to whether the filter he came up with had anything to do with it - I still think that's bullshit.

Vimes

Re: Is Alexander J Martin a professional?

Personally I'd expect to see this level of inaccuracy within the headline in the Daily Mail or Express. Not here of all places...

NHS England backs down over another data extraction scheme

Vimes

Given how many clinics now refuse to take new patients because of lack of resources, I find it difficult to believe that anything gleaned from this could in any way justify either the cost of asking for & processing the required data or any invasion of privacy that results from it.

Vimes

...or maybe it's just so they can remind the patient when they've been identified as a regular user that the visit is 'funded by the UK tax payer'. Much like they seek to do with medication costing more than £20. They want to instill as much guilt in people as possible when they use the NHS that they never go anywhere near it.

http://www.theguardian.com/society/2015/jul/01/nhs-prescriptions-drugs-health-cost-waste-price

It's getting to the point where if I went into hospital I wouldn't be surprised if I was fed alphabetti spaghetti and the words 'just die already' end up appearing multiple times in my bowl. Just by chance of course...

The response to the following FoI request doesn't give me much confidence that they have any sort of clue as to what they're doing - they're going ahead with a scheme without even knowing the benefits, and they probably aren't acting with any more precision or clarity when it comes to appointments either.

https://www.whatdotheyknow.com/request/cost_of_displaying_the_cost#incoming-681133

Vimes

I would have thought if this had gone through that it would have forced GP practices to abandon EMIS. There would be no other way to comply with the 7th data protection principle otherwise (that steps are taken to adequately protect data). In addition I wonder if EMIS would have committed a criminal act had they complied?

It's OK – this was an entirely NEW type of cockup, says RBS

Vimes

A new flaw?

Time for a new fine perhaps?

Downing Street secretly deletes emails to avoid exposure to FOIeurs

Vimes

Re: One rule for the rich..... @I Am Spartacus

Not sure what's with the downvotes, but consider this:

- Anything remotely private or otherwise considered outside the scope for publication has to be redacted from anything released to the public (probably not the case with other legal requirements mentioned elsewhere in this thread since presumably the information is being provided to the government rather than the general public)

- Such redaction probably has to be done by hand, since it's difficult to believe that automated systems could be trusted to do the job with sufficient accuracy.

- More emails to trawl through means more work. This is unavoidable and the cost of the storage will not change that.

Storing emails for longer means that it will actually be easier to hide information, not more difficult, since it will make it far easier for government departments to use s.12 of the act (excessive cost) to deny access. That greater ease in denying access IMO strongly suggests that avoiding the impact of FoIA is not the aim here.

If it was then they would have an interest in keeping things as long as is humanly possible to make any trawl of the information too expensive.

Vimes

Show me the part of FoIA that tells the government how long they need to keep emails (or any file for that matter).

I don't agree with it personally (I think they should be in a position to keep things longer than that, at least where it doesn't involve PII) but there is nevertheless a world of difference between 'should keep it' and 'have to keep it', and as somebody who has no experience dealing with this it would be wrong for me to at least not consider the possibility that there might be some reasons for this as badly thought through as they may be (for one thing filtering out personal information would be in itself a large task given the volume of email)

Vimes

Re: FOI Request: How many emails have come in over the past 12 months?

@Ken Moorhouse

Except that Hansard probably doesn't potentially contain private information that legally can't be stored longer than necessary (and 'in case we need it later' probably wouldn't count since if I recall correctly it has to be for the reasons it was originally collected & used in the first place). The same can't be said of emails, which can contain all sorts of private information not normally part of any government record like Hansard.

Which one is more important? The DPA or FoIA? Letting them think that storing anything remotely private just because it might be useful later on is a very bad idea IMO.

Vimes

Re: One rule for the rich..... @I Am Spartacus

This is done so that they can go in to court and say, truthfully, that all legal discovery is complete and comprehensive.

Again, playing devil's advocate for a moment: I strongly suspect that the number of court cases involving them is easily dwarfed by the number of FoI requests for any single government department that you'd care to name.

That 'legal discovery' costs time and money neither of which the cash strapped departments have much of. Now imagine having to go through all that every time somebody asks for something.

Vimes

Re: "It makes it easier if the nonsense emails aren't there"

"It makes it easier if the nonsense emails aren't there

It's true though if 'easier' means 'less incriminating evidence we then have to release' and 'nonsense' means 'anything that goes against what we want you to believe'.

Vimes

Playing devil's advocate...

http://www.foiman.com/archives/1584

Instagram spam - what the fuck???? I'm not a user!

Vimes

What about the CEO? Or was that in reply to your email to the CEO?

Vimes

Umm.... and what were the security reasons that allowed the account to be created *without* verification from the user I wonder?

Vimes

OR somebody posted a photo of me in a private discussion, tagging it with my personal information, and Instagram have then set up an account and spammed me about it as a way of increasing their userbase.

Possible, but very unlikely IMO. Somehow I suspect that even in relatively liberal countries like the US this type of gathering personal information coupled with the subsequent display of said information to the wider public WITHOUT any form of consent would probably end up breaking a number of laws.

Even Facebook - assuming this is true - when they track people that aren't users they don't then make it publicly visible.

Vimes

You own the fscking email address. Email from that address, ask to have the account removed, and suggest (respectfully) that they respond to your email address to verify that you actually don't want that account to exist anymore. Reply to the response.

If the response from other services that I've received in the past is anything to go by when I've tried something similar then they'll ignore this and demand proof of identity.

Incidentally I'll admit to using Instragram, albeit rarely. I don't recall receiving any email from them when I set up the account with my own email address and when I started the app on my phone I get a message asking me to send a confirmation email to secure the account, but this is entirely optional and there seems to be nothing to stop me from ignoring it.

Vimes

Try emailing the CEO?

http://www.ceoemail.com/s.php?id=75919&c=Instagram

It'll probably end up getting dealt with by the same people, but sometimes having the additional note 'deal with this' from the CEO attached to the call can sometimes encourage them to get it sorted more quickly and to your satisfaction.

Testing Windows 10 on Surface 3: Perfect combo or buggy embuggerance?

Vimes

Re: Decent screen for once

Perhaps I just have better eyesight than most (or just sit closer to the screen) but applications where no resizing appears to be happening - Blender for example - still seem to be readable if a little on the small size. Nevertheless I've never personally had a problem with that on my own Surface Pro 3.

Vimes

How does Windows 10 perform on a Surface Pro 3?

Mine currently seems to overheat extremely easily. I do use it occasionally as a tablet but would be happy to compromise a little on this if I got a tablet that didn't get uncomfortably warm and noisy just from playing Microsoft's own Solitaire.

'Snowden risked lives' fearfest story prompts sceptical sneers

Vimes

Re: Au contraire, they certainly want the cluefull to be afraid @Shannon Jacobs

I'm sure their anti-spook spooks detected him

They might have been eventually caught, but the likes of Ames or Hannsen still managed to cause a fair amount of damage. Personally I get the impression you're assuming competence where it may well not exist.

And as for leaking what they wanted: what benefit did the government get from this exactly? Most of what has happened seems to consist of court cases and being forced to limit programs. Unless the agencies themselves thought their powers went too far - unlikely given the effort to protect them - then they seem to have lost more than they have gained (in their eyes in any case - personally I have yet to see anything to justify this extensive surveillance).

Vimes

Re: hush you

Almost as interesting as the hack is the lack of official response from other governments, including our own. How, for example, can they be certain that our own systems aren't just as vulnerable to attack as those in the US?

For that matter they seem to have conveniently forgotten that the leak occurred thanks to a US employee and the only reason UK information was compromised in the first place was because the government here were so willing to share it.

Vimes

Interesting legal shenanigans being deployed by the Sunday Times against those pointing out the problems.

https://www.documentcloud.org/documents/2101948-news-uk-dmca-notification-first-look-productions.html

Vimes

You're assuming that people with a clue are the target of this sort of thing.

They aren't.

It's the general public. A far bigger group that collectively have the attention span of a concussed kitten. And are also generally easier to fool.

Commish snaps on rubber gloves, Amazon readies itself for antitrust probe

Vimes

If Amazon are found to have acted in the same way that Apple previously tried, then surely that would make them just as guilty? That stuff to do with contract terms being at least as good as competitors in particular sounds eerily familiar.

Personally though I'd settle for getting the same treatment as US customers. There are a number of both audio books and ebooks not available to people in the UK despite them being available on the other side of the pond - and not new ones either, since the ones I'm currently trying to find are old Asimov novels.

Top Eurocop: People are OK with us snooping on their phone calls

Vimes

Re: The UK Police

I should add that I was referring to a warrant issued by a third party that has no direct interest in the request being either granted or denied (so that some degree of oversight of those making the requests is maintained).

If memory serves the authorisation for such surveillance can come from anybody with sufficient authority to do so. This includes the chief constable.

So the police can authorise itself to spy on people using RIPA as their legal cover.

Is this really 'the right area' in your view? Or is 'because we say so' sufficient reason?

Vimes

However, he still made the now-standard case of all police that they need more data.

Why?

Despite all the cries of 'because terrorism' I have yet to understand how more access can actually help the situation. Look at the cases 'foiled' by the likes of the FBI for example: they seem to include cases where the only reason the idiots got anywhere in the first place was because the agency helped them in order to entrap them (*). Even those working for the NSA have admitted that they're having problems dealing with the levels of data they're currently collecting (**), so how will it help matters over here if we repeat those mistakes?

'Should have lawful access'. I think most people would agree with that to an extent. The problems start when 'lawful access' means no control over how much is accessed and insufficient judicial oversight (and this includes a lack of needing warrants).

(*) https://firstlook.org/theintercept/2015/03/16/howthefbicreatedaterrorist/

(**) http://www.zdnet.com/article/nsa-whistleblower-overwhelmed-with-data-ineffective/

Ex-Microsoftie in worthless Euro netizens data security promise

Vimes

'With Zettabox your content is safe from cybercriminals and foreign government intervention.'

Strictly speaking true for a given value of 'foreign'.

EU digi-chief to meet ministers and sort out the net neutrality thing

Vimes

If any user is using too much then you penalise them, not the services being used by everybody, including those not breaking any rules.

Anything more than that is profiteering, pure and simple.

For that matter when it comes to work, how many complaints about service turn out to be from people trying to use their residential connections for commercial reasons?