* Posts by Pascal

198 posts • joined 25 Dec 2009


Huawei sales director nicked in Poland on suspicion of 'spying'



It's funny how some people think China is that retrograde country filled with such incompetent populace that its economy would collapse and it would lose all skills needed to do anything relevant if a few expat workers were to leave.

Yes, you can remotely hack factory, building site cranes. Wait, what?


How does "Offline" and "Wireless" fit in the same conversation exactly?

"It's really a philosophical issue rather than a technical one. On one hand, you don't want to load something down with security implementations when it's a strictly private offline network."


This must be some kind of mistake. IT managers axed, CEO and others' wallets lightened in patient hack aftermath


Re: It might have as much to do with who was affected as with local culture.

Indeed. The prime minister was affected, so heads had to roll.

You were told to clean up our systems, not delete 8,000 crucial files


Re: xfer

I took an even worse habit of just hooking up the old drive to a new system. My current home desktop has its own fast ssd + big hdd pair, and then it also has the drives from the 2 previous generations hooked up "to be sorted later".

Yes there are backups of that mess.

But I don't see myself sorting it out any time soon.

Maybe next system.

Cathay Pacific hack: Airline admits techies fought off cyber-siege for months


"The airline has set up a dedicated website"...

... That asks you to provide them location data!

Because why let the fact the site is about a data breach, get in the way of collecting more data?

Junior dev decides to clear space for brewing boss, doesn't know what 'LDF' is, sooo...



"Or is it all self-tuning and autonomous for all but the most esoteric setups?"

More or less.

You can get cheap all-flash storage arrays that can do 100,000 x more IOPS than you had access to during the classical period, and of course nobody runs databases against pentium 3s with only a few Mb of RAM...

So unless you have top tier requirements It's easy to just throw hardware at a problem to make poor design go away.


"Why would database software be written such that deleting an ancillary file ( such as a log file of historic steps) cause it to fall over?"

Because the transaction log of an SQL server is anything BUT an "ancillary file".

SQL Server transaction logs are actually split in virtual log files, that are used in rotation. All transactions are written sequentially to it and eventually it goes back to the start / 1st virtual file and starts over, ever-overwriting old transactions.

Other than being where current, non-committed transactions are serialized to allow for rollback or for recovery in case of power loss / unexpected shutdown, it also serves multiple other purposes and that's where "runaway transaction log files" tend to happen to people, but those are actually an indicator of something not configured correctly or something else being broken.

The issue is that those virtual log files can only be reused once they can be cleared; and a few things control how and when they can be cleared.

One thing is ongoing, uncommited transaction. Put simply if you have 10 Gb of uncommited transactions, and 5 Gb of transaction log files... Well, the file will grow. That's normal, otherwise the transaction can't happen.

But SQL Server also has different recovery models (related to how you backup/restore a database).

A "full recovery" database is designed in such a way that by combining (full / differential) backups and transaction log backups, you can do point in time restores down to an exact transaction.

To do that however all transactions must also be backed up! So until a specific virtual file is fully backed up, it can't be freed for reuse. It's typical for fully logged database to have a very fast transaction log backup regime (think 5-15 minutes), because the transaction log must hold all transactions until they're backed up.

If someone sets a database to be fully logged, and then does not get a transaction log backup schedule going, well... They log fill will grow indefinitely, because... well because that's what they asked it to do.

Another reason is replication. The various replication schemes that exist in SQL Server are based off the transaction log: transactions that are commited on the source server, are transferred to the transaction log of target server and then also commited to the datafiles of the target servers. Any virtual log files that contain data that is not yet replicated to even just one of the target server can't be cleared for reuse, so broken replication configurations / failed servers can be a reason for transaction log files bloat.

Oh well I could keep blabbing about that, but yeah confusing transaction log with just "log files" is a classic mistakes that bites every SQL dabbler in the ass eventually :)

Nikola Tesla's greatest challenge: He could measure electricity but not stupidity


Re: country & western singers

The list is a good first draft, but you really should bump "influencers" up a bit. Probably above country singers even.

Sendgrid blurts out OWN customers' email addresses with no help from hackers


The way it works is that messages they send out have unsubscribe links.

Those links ask for confirmation - displaying the name/address about to unsubscribe, and from what list.

This isn't supposed to be crawlable as nothing refers to those URLs in the first place, and robots.txt files block those paths from indexing.

But then people receive messages and post the full message to various forums or other public sites- for whatever reason (sharing messages they got, etc.) and they don't remove those link.

The forums are indexed, and follow those links -- and Google explicitly ignores robot.txt for content linked from other sites, they only honor explicit headers in pages under that circumstance.

The leak really originates from specific users posting their messages online, added to Sendgrid not understanding how google indexing / robots.txt work.

This specific scenario has happened to most major online services like that - any service that has any sort of links that automate access to any types of profiles is susceptible to that kind of indexing when users don't understand where they're posting those links.

Australia's Snooper's Charter: Experts react, and it ain't pretty


Re: GDPR compliance

Of course. GDPR has exceptions tailored exactly for that.

GDPR basically goes "You shall not retain data without user permission, except if you have any other legal reasons to do so".

British Airways' latest Total Inability To Support Upwardness of Planes* caused by Amadeus system outage


Re: weight calculation

"You do these calculations before you load the cargo into the plane. Having the plane measure it and then say "oops, that's outside the safe limits, you need to unpack and rearrange" is sort of not helpful..."

Then hum... Why were the passengers sitting IN a plane for 3 hours? Surely they should have done the calculations before letting them board?

Tired sysadmin plugged cable into wrong port, unleashed a 'virus'


I looped switches like that too once, except...

.. that when I did it, I also took down a border router of my then-ISP, which apparently disrupted service to a few dozen other customers of theirs.

Happy times :)

App devs bewildered by last-minute Google GDPR klaxon


Technically, because if your app is free and ad-driven, they're not your customers, they're your product. Hasn't that been the generally accepted consensus for a while already?

Anyway I hate ads as much as the next guy and would rather pay for an app than have ads, I think it's the most annoying shit that can ever be put in a mobile app.

But it seems Google also fucked up in the sense that GDPR doesn't require consent to show ads, it would only requires consent to track users (so personalised ads)? Shouldn't their API be about consenting for personalized ads (with tracking) vs generic ads, without forcing the "no ads" option?

Equifax reveals full horror of that monstrous cyber-heist of its servers


Re: And how...

> "It would also break the secondary market for debts as well, because if companies can't share that information, they can't sell your debts to anyone else"

Oh, the humanity! What would we ever do if that insane, mafia-like "secondary debt market" system disappear? We'd have to shutdown society or something.

Secondary debt racketeers are just about as useful to society as pedophiles and murderers, and should be treated the same.

It's not you, it's Big G: Sneaky spammers slip strangers spoofed spam, swamp Gmail sent files


Small subset my arse!

> "We have actively taken measures to protect against a spam campaign that impacted a small subset of Gmail users."

I had dozens of them. They came complete with a (brand new I assume) banner stating that "We can't confirm that you sent this message or not, headers may have been forged".

They have since updated the banner to say the message "seems to be a fake bounces reply to a message I didn't actually send".

From inspecting the message source it seems they spoofed a lot of things, including Message-ID formatted google-style that might have been what tricked Google.

Cinema voucher-pusher tells customers: Cancel your credit cards, we've been 'attacked'


Re: UK Law Must Introduce Guest Checkout

You don't even need guest checkout, just don't save credit card info after payment -- or at the very least, let the customer decide if you should "remember" that credit card.

2 + 2 = 4, er, 4.1, no, 4.3... Nvidia's Titan V GPUs spit out 'wrong answers' in scientific simulations


Re: Shades of the Pentium floating point bug?

I am Pentium of Borg. Division is futile. You will be approximated.

Programming languages can be hard to grasp for non-English speakers. Step forward, Bato: A Ruby port for Filipinos


Re: Nope, it doesn't work

Earlier (before the year-based versioning) it did in fact save "SOMME(...)" and wouldn't load in an english Excel.


Re: Nothing new here

Even Microsoft did it back in the 90s.

VBA was localized so that code written in Excel / Access / etc. would use a french syntax in my version. "SI/ALORS/SINON" instead of "IF/THEN/ELSE" and so on.

And the crazy part was that it wasn't saved in an intermediate form. So an MDB file with code created on a french Access wouldn't work on an english Access.

Then in the early 2000s there was a push by the OQLF here (Office Québécois de la Langue Française) to coerce IT to switch to french; including threads to be barred from government work for including such evil anglo constructs in HTML pages as "é".

Much joy.

Cluster-f*ck! Etcd DBs spaff passwords, cloud keys to world by default



"it seems as if people may not be using etcd's security capabilities and leaving the ports open, which can be a problem with every database"

Yeah but... CAN IT really? Does EVERY database really come with ports open by default that allow access with zero credentials "unless you enable some feature"?

I'm sure we can collectively come up with at least one or two that don't quite work like that...

XM-Hell strikes single-sign-on systems: Bugs allow miscreants to masquerade as others


single point of failure maybe,

But the alternative is requiring people to have 15 login/passwords to 15 systems.

This results in the same password being used everywhere, or passwords written down on post it notes, and so on.

And obviously, 15 actual point of failures within 15 different login processes.

In theory one secure and thoroughly vetted sign-in system should mean less risks.

Microsoft works weekends to kill Intel's shoddy Spectre patch


Re: The WinTel Cartel...

In this context they're passing along microcode updates produced and vetted by Intel, as part of a very urgent, very critical security update. You really want to lay that one at their feet instead of Intel's?

UK, US govt and pals on WannaCry culprit: It woz the Norks wot done it


But he's a government official and he pinky swears it, surely that's proof enough?

Mailsploit: It's 2017, and you can spoof the 'from' in email to fool filters


> DMARC only reports if your policy is set to "none", it can quarantine and reject mails if you like. or am I missing your point?

DMARC lets you broadcast a policy, that tells the world what *should* be done about messages coming from your domain and that are not authenticated a certain way. DKIM is one of those authentication methods and it can actually protect the domain used "from:" (the one in the message, not the smtp envelope). There are a lot of problems still however:

- Adoption rate is very low at the sender level (only a tiny % of domains have proper spf, dkim and dmarc policies in place)

- Adoption rate is still so-so at the received level. It's a much higher %, but there are still stupid situations like Microsoft still not doing shit about DKIM, and *lots* of self-managed smtp servers don't handle these things properly

And of course none of those policies, and use of those policies in email filtering, will do anything about the fact that most email agents are complete garbage. Take Yahoo for instance, you can mangle the subject line so much that it can alter their webmail GUI, still to this day.

Please activate the anti-ransomware protection in your Windows 10 Fall Creators Update PC. Ta


That, or your outlook.exe lacks the proper signature, and isn't the one on the whitelist. Scan for virii? :)

(My Outlook from Office 2013 had no problems writing to my document folders when saving an email attachment after enabling this).


The obvious unfortunately. The unsecured one scrambles the files, syncs them to dropbox, from where they get synced back to the secured device. If only the unsecured device could have read-only access to your cloud data...

Google slides text message 2FA a little closer to the door


"The article says Google now has a system where you have to reply to a text. The act of replying acts as the validation in the server - there is no code to input"

No SMS or reply.

Their new method sends a push notification to the app. The app then prompts the user somehow ("Looks like someone's trying to log into your account from *location*. Is that you?", with allow / block buttons). Upon pressing allow/block, the app calls a Google API to complete the process.

So yeah it's a 2-way street but it's data communications, not SMS, which is the hey as SMS has been proven to be vulnerable to SS7 and it was effectively exploited in the wild already.

End result is extra security because push notification subscription are "secure" (only the owner of the app can push to a specific phone/installation and no known hiijaking of that has happened yet) and the specific install on a phone is the only owner of the key necessary to sign the response message (the public part of which is sent to Google as part of the enrollment process).

In the end it's one more tool in the 2FA toolkit. Google aren't forcing this, they're offering it as a more secure version of SMS. You can still use authenticators that don't require sms or data connections.

'Israel hacked Kaspersky and caught Russian spies using AV tool to harvest NSA exploits'


So... Israeli intelligence, in the process of hacking Kaspersky for (probably exactly the same purpose), discovered that Russian intelligence had beat them to it?

Where's the popcorn icon?

Apple's iOS password prompts prime punters for phishing: Too easy now for apps to swipe secrets, dev warns


One way ...

To truly differentiate system password prompts from application-generated password prompts (including fake password prompts) would be to include contents in the system login prompt that is selected by the used when creating their account, and is never visible to the App landscape under any circumstance.

My bank for instance issues a favorite picture selected from a bank of hundreds along with a "personal saying" type phrase that was entirely typed in by me;

After years of seeing the same picture and text on their login screen, I would say I am phishing-proof (*).

It would be easy to implement by Apple / Google, and would mean the system login prompt is a "personal" thing that always has the small P.S. note "we'll never ask your password without showing those!"

Then give it ~5 years for users to train themselves.

(*) ok, so for varying degrees of "proof", but at least not spoofable unless a seriously bad leak already happened.

Support team discovers 'official' vendor paper doesn't rob you blind


Re: "opting for cheaper 3rd party labels"

I had a very nasty argument with one of those high end audiophile shops when digital stuff started showing up - he was trying really hard to prove to me that his ~$300 gold-plated, HDMI cable was so badass that colors would be brighter, blacks would be darker and general contrast/sharpness would be better.

Complete with 2 TV sets showing the same movies, with "exactly the same things except for good vs cheap hdmi cable", to prove how shitty it was to watch a movie with a cheap $50 HDMI cable vs his expensive one.

2019: The year that Microsoft quits Surface hardware


Re: Surface, the Apple iPad/MacBook wannabe

Another way to see it is that Surface's goal was to give the OEMs a solid kick in the behinds, and wake them up from all the terrible, terrible hardware they were making.

Just look at screen and storage.

As apple was coming out with retina displays and ssd storage in their laptops, it was still considered a premium, high-end, "costs 100s of dollars more" feature to get an 1920x1080 display from Dell, HP and the like: they were very comfortable still peddling those 1366x768 pieces of junk in overweight laptops with storage that felt slower than my old 20 Mb RLL drives from the 1980s.

The current surface line-up clearly has those heat / etc. issues but calling them iPad wannabees is ridiculous.

Pumpkin bumpkins battle, 800kg monstrosity wins


That's an impressive pie!

> "The winning vegetable actually weighed in at 792.5kg, or enough to make 100 pumpkin pies serving around 800 people. Despite this bulk, it still came up well short of last year's 900kg record."

We're talking about 8 Kg of pumpkin per pie!

Twitter's 280-char blog mode can be enabled client-side. Just sayin'


Re: Never understood why ..

Holy crap if SMS is "a technology that most people don't use these days" I must live in a weird place :)

But at any rate twitter limit was in no way technology-related, it was a design choice, they wanted to create an instant short-message feed. It's part of their branding, so to speak.

As another poster said, make it unlimited and they'd be just another Facebook knock off.

Developer swings DMCA sueball at foul-mouthed streamer PewDiePie


Re: Perjury

Is it?

I don't care about pewdiepie or that specific game / developer, but I'm genuinely asking from the legal standpoint.

I'm assuming game developers have some rights / control regarding this, and streamers would need their permission and/or could be asked for some licensing fees? After all, (some) streamers are making a living out of this, in somewhat (and I'm really stretching here probably) the way that cable companies make money off the TV channels they carry, but in exchange for license fees. Of course game developers certainly must be getting lots of sales out of the deal (endless hours of free advertising).

I really don't know (or have any very clear opinion either way), but does anyone know the "legalities" of this?

SpaceX sneaks in X-37B space plane launch ahead of Hurricane Irma


Re: Getting bored now

It's fascinating how in such a short time they went from spectacular explosions to making those perfect landings feel like routine. Soon it'll barely be a footnote to the stories!

Seeing from the onboard camera, coming down from space at 3500+ km/h to land right in the middle of the logo is just amazing!

US Navy develops underwater wireless battery-charging tech


Re: How is this still a thing?

The point of this however is standardisation. They want to develop a standard that they'll impose on their vendors so that they don't end up with incompatible kits (so whatever form their charging stations take, they don't have to deploy 6 versions of them if they have 6 UUV vendors).

New York Police scrap 36,000 Windows smartphones



You let an underling decide on a technology / supplier / etc. on a multi-million deal because she's difficult to get along with?

Honestly her boss is as much to blame as she is... More, probably.

Did ROPEMAKER just unravel email security? Nah, it's likely a feature


Re: Why Do People Expose Themselves With HTML E-Mail

That's only true for what is nowadays a very small, old-school slice of email users.

Everybody else at the very least can't understand why anyone would tell them they can't have bold, italics, etc. in text they write to someone.

And we're not even talking about the crazy idea that people who get their news, etc. via daily emails should get it in black-and-white text with no headlines / etc. whatsoever.

Email *was* a text medium. Decades ago.

Sofa-jockeys given crack at virtual Formula 1 world championship


Re: Tight squeeze

> Eh? They've still got a brake and accelerator

F1's really high tech now, they scream engine / braking onomatopoeia into their helmet microphone for that.

Vroooom, Vroooooooooom, Vrooooooooooooom, Vroooooooooooooooooooooom!



Creepy backdoor found in NetSarang server management software


Re: IP-Land

That's more or less what your firewalls are for, it's just that most people still assume firewalls are only meant to protect from external threats.

So they still allow, for instance, all servers to connect to any IP in the world using the basic protocols (http/https for instance).

Seems that financial client of Kaspersky was actually doing thing rights, and actually investigated blocked outgoing traffic to the point of hiring Kaspersky to figure out what was causing it.

But in the end your idea is just another approach that would generally not be implemented for the same reasons -- so many people assume traffic originating from their own systems is legitimate by default.

Hell desk to user: 'I know you're wrong. I wrote the software. And the protocol it runs on'


Re: Did you ever hear of the Seattle seven?

The dude abides.

Bitcoin exchange Coinbase crashes after Asian buying frenzy


"Japanese interest rates are actually negative at the moment, meaning it costs money to save"

How is that even a thing?

UK Home Office warns tech staff not to tweet negative Donald Trump posts


Re: Absolutely uncalled for...

"I dunno, Justin Trudeau seems to be doing pretty well on his own."

This is a gross oversimplification but...

Trump got elected because he ran a popularity contest out of his reality TV "star" status / outsider status.

Trudeau got elected because he's cool and popular on social media.

More than ever voters basically make decisions based on popularity contests, this does not bode well for the future of mankind :)

81's 99 in 17: Still a lotta love for the TI‑99/4A – TI's forgotten classic


The first computer I owned...

I had the occasional brush with an Apple IIe before (where I learned some very, well, basic BASIC), when Sears liquidated their stocks in ~83 or 84, my parents bought it for me.

Soon enough, I had scrounged the extra peripherals - the speech synthesizer, the external expansion (with slotted RAM on an external bus AND a floppy) and, the grand prize of them all, an ASSEMBLER cartridge that basically gave you access to assembly coding.

So there I was at ~12 years old, having only a few months of self-training in BASIC, learning assembly on the TI-99/4A with zero resources other than a 4-inches thick manual in english (which I needed a french-english paper dictionnary at the time to understand).

Good times!

That's what got me started anyway, so I still have great memories of this little computer.

Microsoft's Blue Screen of Death dead in latest Windows 10 preview


> It's the new agile, dev ops combination bringing energy and innovation to the customer.

energy? you must mean synergy!

'Upset' Linus Torvalds gets sweary and gets results


Re: Linus needs to start looking for his replacement.

> "Linus needs to start looking for his replacement."

On a somewhat more serious note, this is something I've wondered about from time to time. I only follow Linux Kernel development from articles here so my view is obviously completely skewed, but these articles definitely make it sound like Linux is what it is almost entirely due to Linus Torvald's vigilance and strict refusal to let any shit slip by. In a sense, if feels a lot like a personality cult, him being the glue holding everything together.

What happens when he retires years from now, having properly handed off stewardship and all is one thing.

How would Linux look like 5 years from now however if he died in an accident tomorrow? Is there a clear path of succession, or would things just devolve into 10 forks from people with different ideas?

I'm not criticizing or anything here, mainly I'm curious to hear from people that know about it more than from El Reg's headlines :)

Trump meets Google – exclusive transcript


It's hard to decide which side to root for!

see title ;)

Persistent ad and dialler trojans found on 28 Android phones


Re: So which antivirus is the best for Android

> "Go and get a not-so-cheap android phone."

And what is wrong exactly with a cheap phone?

God forbid some of us see phones as actual, you know, phones, not as a social status symbol to be derided if it's not worth more than a reasonable desktop computer.

Double-DIMMed XPoint wastes sockets


Re: Whats up with those numbers?

Yeah I think there's a math glitch here?

The author is counting 500 cache misses instead of 50,000.

It should be:

((950,000 x 1) = 950,000) + ((50,000 x 5) = 250,000) = 1,200,000 time units


((950,000 x 1) = 950,000) + ((50,000 x 50) = 2,500,000) = 3,450,000 time units


Biting the hand that feeds IT © 1998–2019