* Posts by Twanky

77 posts • joined 17 May 2017


Return of the audio format wars and other money-making scams


Spear phishing e-mails?

Yeah, what we need is some software that will show us where the e-mail actually came from rather than the display name requested... Oh, hold on - that's too old fashioned...

Seriously: can we not agree to use SPF, DKIM, S/MIME (and even DMARC) etc to stop fake e-mails getting through? I get it that the FD (for example) doesn't feel the need to understand this sort of thing but Shirley the guys in charge of the tech can specify software that shows when a message fails these checks.

I get so many messages that apparently come out of UK local government or academic establishment domains and those domains have no or lax SPF and non-existent DKIM controls in place. Absolutely crap. If messages that failed SPF and/or DKIM were clearly labelled "not to be trusted" by Outlook or Thunderbird or whatever then maybe the domain administrators could be persuaded to help clean up their organisation's reputation. Alas, I fear the reaction would instead be to accept that the "not to be trusted" label is not to be trusted.

Redditors start flinging Pooh after mega-forum takes cash from Chinese behemoth Tencent


"quality rather than quantity"

"Here at El Reg we are of the belief that it's more about quality rather than quantity when it comes to forum contributors"

You smooth-talking bastards.

Oh all right, just a quick one then.

How I got horizontal with a gimp and untangled his cables


Forward planning

We moved into a newly refurbished office and I had to fight for the budget to flood cable the place to Cat 6 standard (actually to the then-anticipated Cat 6 standard) To avoid the need for future cabling changes I specified 4 ports per proposed desk space. I also insisted that the cabling guys should install draw strings in the floor voids so that we could install yet more cable if (when) we needed to. I overheard one of the cabling guys complaining about the draw strings and that they would do them out of future work...

Needless to say after a few years we began packing desks together in tighter clusters and ran out of cables/ports in some areas. It was then that I discovered that the installers had cable-tied the draw strings to the floor supports.


Romford Station, smile! You're in London cops' final facial recog 'trial'

Big Brother

Re: Orwell ain't seen nothing yet

Attention citizens: Police are currently looking for a suspect with a facial tattoo that looks a bit like the imprint of the heel of a size 12 police issue boot.

Chang'e 4 wakes and Yutu 2 stretches its solar panels for another day... on the friggin' MOON


did China build a movie studio to mimic the Moon surface?

Of course not! Somebody would have noticed differences between the NASA Moon surface and theirs. No, they're all in this together I tell you; they used the same studio.

As for: 'if the Moon is flat too?'. Bloody ridiculous! Whoever heard of flat cheese?

Oh, wait....

Office 365 enjoys good old-fashioned Thursday wobble as email teeters over in Europe


Re: And this is why

Yes. But... They paid me off and then I retired.

I did keep in touch with former colleagues. Apparently the costs went up and the reliability went down - but to try to be fair any change is likely to introduce more costs before any payback.


Re: And this is why

Our new CIO wanted everything moved to 'the cloud'. I asked why. I was disappointed to be told that he 'didn't want the company to be left behind'. I'd rather hoped for something along the lines of 'to save money' or 'it's more secure' or 'less downtime' - you know: something measurable. Bah!

Icon because that's what I had to do --->

I was made redundant a year later... :)


Re: Day one of Office 365 outages in 2019?

'My money is on 333 days for 2019'

What? You reckon they'll have 333 days downtime? Shirley that's a bit pessimistic?

French diplomat: Spies gonna spy – there aren't any magical cyberspace laws that can prevent it


are spies allowed to use secure encrypted communications then?

Only if we trust them.

Oh, wait.


I don't think we need a new global agreement to stabilise cyberspace

I agree with M. Heilbronn.

If we *did* have such an agreement it would need an international verification body. <sarc>Perhaps teams of observers to make sure that signatories don't have their fingers crossed behind their backs as they sign the treaty.

After all of the recognised nations have signed up the body could move on to negotiating similar agreements with terrorist groups and organised crime bosses. What could possibly go wrong?</sarc>

By far the best way to achieve global stability in cyberspace would be to harden the bit of it that each nation has authority over.

"No Mrs Trellis, you can't connect that IoT crap to your BT Internet HomeHub; you're putting our country's infrastructure at risk". If she won't disconnect it then disconnect her house. Take a similar approach to companies.

When our own state's cyber experts discover a vulnerability in some common piece of kit does the state take the view that the vulnerability should be fixed before it is used against us or does it store the knowledge and use it against some other state (or terrorist group or crime boss) - and thereby leave it's own citizens open to attack? I know which approach would lead to more stability.

We need to *learn* from each other's mistakes. I reckon that when the news broke that Germany's Chancellor Angela Merkle's communications had been intercepted by US state actors the reaction among Germany's spooks was not "how could they do that to us?" but "how could we have let that happen?".

We've analyzed their attack, sir, and there is a danger. Should I have your ship standing by?

Ooh, my machine is SO much faster than yours... Oh, wait, that might be a bit of a problem...


More powerful?

I worked at a company that had an IBM 4381 for 'business computing' and some microVAX IIs for 'R&D computing'. I worked on the R&D IT side of things. One of the microVAXes had the SAS package for statistics analysis and we had serial (LAT) attached LN03 laser printers and 6 pen HP plotters for printed output. To test the plotters we used to run a SAS script to generate a 'cowboy hat' plot.

The company got taken over and some consolidation was imposed; the two 'computing' functions were to be merged and the 'toy' microVAXes done away with. SAS for VM was installed on the 4381 and we migrated everything over from the VAX environment to VM - with various REXX scripts to ease the transition for the users (for example by making RSCS look a bit like VAXmail). To test the system I ran the 'cowboy hat' SAS script - and got a worried call from the IBMers 'DP manager' asking what the hell was the going on. The interactive/intermittent load was nothing like the predictable batch processing load he was used to.

Goddamn the Pusher man: Nominet kicks out domain name hijack bid


Similar experience

A company I worked for handed responsibility for buying and maintaining domain names to one of the marketeers. The guy bought every variation of the company's (already too many) domain names to 'protect the brand' - it cost a fortune. I never did understand why the marketeers in general thought that any potential customer might visit <boring name>.XXX and expect to reach <boring company>. A year or so later a long-standing customer told us that visiting <boring name>.co.uk now took him to a different company's website. Oops. The marketeer had left our company and his company e-mail address which had been used for registration had been closed down. The related paperwork had been filed in the 'I don't have time for this technical shit' folder by his former colleagues.

Cue much finger-pointing.

If I could turn back time, I'd tell you to keep that old Radarange at home


Line of sight

A company I used to work for had an office in Lagos, Nigeria and they needed to expand and move from one area to another. The ISP proposed a microwave link across the city (cable infrastructure is insanely tangled and unreliable in the city) and offered two alternative prices. Officially licensed/registered with local government, or not. Licensed/registered was more expensive (of course) but offered the benefit that if anyone planned to build a high-rise across the line of sight of the link then we'd get some warning. In what seemed an unusual burst of candour the sales-bod told us licensed/registered was probably not worth it because high-rise buildings were going up anyway and existing buildings were getting additional floors added without any pre-registered plans.

Silent night, social fight: Is Instagram the new Facebook for pro-Trump Russian propagandists?


...the internet titans were extremely unhelpful...

Wait. What? You mean the companies who run the social networks were reluctant to do anything to highlight how they can be misused*? Whodathought? Why would anyone expect these turkeys to vote for Christmas?

*It's one of those irregular verbs:

I share interesting memes.

You place political adverts.

He pushes propaganda.

We present the facts.

You are economical with the truth.

They are treacherous lying bastards.

Giraffe hacks printers worldwide to promote God-awful YouTuber. Did we read that one right?


Re: Why open port 9100?

'Nothing to do with IPv6.'

Erm... yes it could be. IPv6 can make devices reachable when they were not on IPv4.



I read this article earlier today when there were fewer comments - I can't be bothered to read the rest of the comments on this article so if someone else has already made these points then please feel free to express your outrage in the usual manner.

Thing 1: I don't follow anyone on 'social media' - or for that matter on mainstream media. At least not that I can think of immediately. So, I know next to nothing about PewDiePie and his output and I'm reluctant to change that. IMO some people seem to be 'celebrities' for the oddest reasons.

Thing 2: Once upon a time I registered with El Reg because I wanted to comment on an article or someone else's comment. I don't intend to research what it was. The point is: something touched a nerve and I signed up to be able to comment. PewDiePie's supporters (and for all I know some detractors) have done the same. I really don't mind, everyone has to start somewhere.

Thing 3: I only watch cat (and dog) videos on YouTube that manage to get past a very effective filter. If SWMBO tells me I 'have to see this' then it's usually quite funny.

Thing 4: I understand that people who are fans of the most popular talent on YouTube don't want to be relegated to be fans of the second most popular talent on YouTube. That said, all they have to do is change the definition of 'most popular' or 'talent' and they can claim pretty much anything they like. I do get it that there's serious advertising money involved.

Thing 5: Don't tell me I'm old or call be Grandad. I know I'm older then some and not as old as others. I'm not so old that I don't remember being young - sometimes with embarrassment. I'm so old that whenever I read something about PewDiePie I imagine a small canary with an annoying voice (memo to self: must not laugh at people with speech impediments - especially if they hate cats). Only my grandchildren may call me Grandad. They think I'm very old.

Thing 6: IMO the main point of the article is about insecure systems which allow total strangers to print on your printers (and probably worse). In terms of security lessons learned it might have been better if the miscreant had printed a few thousand pages with something like 'This page intentionally left blank' - but then he might not have got any new subscribers for his hero.

UK rail lines blocked by unexpected Windows dialog box


Re: headcode

or Pelham 123?

UK.gov to roll out voter ID trials in 2019 local elections


Re: two forms of non-photo ID...?

"their whole presence is in their husband's name. Why would we deny them the vote?"

We *should not*, of course. However, it seems obvious to me that for many women who fall into that category this would effectively give their husbands two votes. I don't know how to square that circle. Perhaps if candidates tried to address the issues that the majority of people face it might help.

SQLite creator crucified after code of conduct warns devs to love God, and not kill, commit adultery, steal, curse...


There is NO rule number 6

Rule number 7...

OK, OK, I'm going...

Convenient switch hides an inconvenient truth

IT Angle

Re: stairs and hallways lights...

Disclaimer: I am not a qualified 'sparks' and may be out of date with current regulations but - Shirley some mistake?

The two switches are two-way and have two possible paths for the 'switched live' between them. If both switches agree on the path then the switched live is connected to the load and the light is on. If the switches disagree on the path then the light is off.

What do Zuck, Sergey, @Jack and Bezos have in common? They don't want encryption broken


Re: Go Dark

IMO that would get them barred from any discussions about the future legislation - so they would lose influence over its development. Yes, by the sound of it the proposed legislation is crazy but drawing lines in the sand and daring people to cross them rarely moves a discussion forward.

icon: save the nuclear option until all else fails.

Scottish brewery recovers from ransomware attack


'organisations should pay'?

If I were running a ransomware operation I'd want to take a look at whatever was so important that a victim agreed to pay for it. If it's that important to the victim then it's probably worth a higher ransom.

Why would you trust the bad guys to provide the decryption key once you've paid? They're bad guys.

As for 'losing 3 months worth of sales data'... it's a valuable lesson which the brewery could probably have learned at a lower cost.

I very much approve of small breweries in general though - I'll make a point of sampling their product soon.

I want to buy a coffee with an app – how hard can it be?


Re: Don't tell them your name

Don't tell him, Pike!

Judge: Georgia's e-vote machines are awful – but go ahead and use them


Re: "Not Enough Time"

Dangerous precedent^Wpresident...



Voter of the Year

2008 has been and gone but we're still not quite ready to select the voter who will represent the rest of the people at an election?

£1 in every fiver that UK biz, public sector spent on software in 2017 went to *drumroll* Microsoft


Re: Don't hold your breath...

Oh Crap!


'30 March 2017 published amendments

Introduction to Open Document Format (ODF)

This has a new intro as it was unclear software needs to be downloaded before using ODF.'

We're doomed.


Don't hold your breath...

...but: https://www.gov.uk/guidance/open-document-format-odf-guidance-for-uk-government

Maybe one day.

You want how much?! Israel opts not to renew its Office 365 vows


I wish the UK goverment had this capability.

See https://www.gov.uk/guidance/open-document-format-odf-guidance-for-uk-government

I particularly like the bit where it says 'The UK government has selected ODF 1.2 as the standard for editable office documents to be used across government.'.

Across government. At all levels. Cash-strapped local government authorities please take note. Yes, that means use LO or similar in the schools - not just in the classrooms but for admin too.

What's that noise? Damn, I must have been dreaming.

The Death of the Gods: Not scared of tech yet? You haven't been paying attention



Johannes Gutenberg: It's all downhill from here.

Google Spectre whizz kicked out of Caesars, blocked from DEF CON over hack 'attack' tweet


Re: "If I had... ...the motive..."

'"I've not yet figured out how to reliably communicate with this subspecies. Leads to issues..."

Short and shouty is the most reliable way. Ignore facts, they're just inconvenient. Raise up boogiemen to attack.'

What? You mean like in no more than 140 or 280 characters?

Supermicro breathes in, shimmies a PB of Intel flash into one rack unit

Thumb Up

I'd buy that for a dollar!

"El Reg has yet to receive pricing and availability information for Supermicro's latest 1PB 1U box, but anticipate the $/U rating will be on a par with the PB/U value."

Amazon meets the incredible SHRINKING UK taxman


Re: Just remember

"For every pound successfully avoided by Amazon et al, YOUR tax rate has to go up to cover the loss in income."

No. That's only true if the treasury insist on balancing the books at the end of each tax period. If they're willing to run a deficit for multi-year periods then it won't be YOUR tax that has to cover the shortfall - it'll be a future generation's.

Grad sends warning to manager: Be nice to our kit and it'll be nice to you


Toughbook? pah!

We issued lightweight notebooks (Dell D420 I think in this instance). Then there was a guy who brought his back having checked it into hold luggage and watched his bag fall off the luggage carriage and get run over by it at Caracas airport. The screen was crazed and the chassis/body was bent but the damn thing still worked if you could pry it open. We kept it in the office as a display item.

First low-frequency fast radio burst to grace our skies detected at last


People of Earth...

...your attention, please. This is Prostetnic Vogon Jeltz of the Galactic Hyperspace Planning Council. As you will no doubt be aware, the plans for development of the outlying regions of the Galaxy require the building of a hyperspatial express route through your star system. And regrettably, your planet is one of those scheduled for demolition. The process will take slightly less than two of your Earth minutes. Thank you.

Facebook deletes 17 accounts, dusts off hands, beams: We've saved the 2018 elections


I really don't understand

An organised bunch of people post divisive political opinions. Then some other people say the first lot shouldn't be allowed to comment on the politics because they are not of 'our' country... Does that mean we should not allow people to comment on the politics in Iran, North Korea, Nicaragua (etc ad nauseam) unless they can demonstrate that they live there? If so, Mr Trump should rein his neck in.

Yes, propaganda on social media is a problem. More effort should be put into completely destroying trust in it as a source of news - instead we get 'don't trust them, trust us'.

Why does anyone expect *any* news reporting to be unbiased? It costs money to do. Reporters, editors and the delivery medium (printing press, paper, web server, whatever) must be paid for. There Ain't No Such Thing As A Free Lunch. Whoever is organising the lunch gets to choose the menu.

Sysadmin trained his offshore replacements, sat back, watched ex-employer's world burn


Re: Logic bombs are unprofessional

'The surest way to get a boss and possibly the whole company into trouble is do exactly what he requests. Nothing more, nothing less. No need for logic bombs, or fiddling with expiration dates.'

I became surplus to requirements shortly after the IT team I was in was expanded with additional capacity/members elsewhere in the world. I was a long-term employee (lifer) and was *very* interested in making sure that my absence would not get the company into trouble - I owned some of its shares. As for the 'manager' who decided that I was redundant - meh.

I ended up fielding a few calls from former colleagues asking 'how does this work?' despite my genuine efforts to transfer as much institutional knowledge as possible during the 'consultation' period. The trouble was that the 'manager' managed to achieve rather low loyalty and retention rates with the rest of the team.

Friday FYI: 9 out of 10 of website login attempts? Yeah, that'll be hackers


the "thats too much of a bother" mentality

For historical reasons I have an account with a bank that uses an additional factor (after username and password) of three characters from my 'memorable information'. The system prompts for a different set of three characters each time I login and requires me to select the correct responses from a drop down list... How much more bother could it be to just type in a six digit code which changes every 30sec?


Re: An honest question.

As a DoS attack vector this would be awesome.

PC shipments just rose, thanks to Windows 10


All your data is belong to NSA

They would have no data on me if they hadn't got it from Experian/MS/Doubleclick whatever.

IBM memo to staff: Our CEO Ginni is visiting so please 'act normally!'


I get the impression that Mr Parko is very concerned about the hierarchy within the company.

So why did he reach down through multiple layers of management to micro-manage the 'team' at Austin? In strongly hierarchical organisations the obvious approach is to say the the next layer down 'see to it that <whatever you want> is done.'. They then hand on the instruction in their own way to their minions. By committing the instruction to a semi-permanent medium like e-mail he can't even repudiate it later.



Parko: 'No ...elevator pitches...'

Drone: 'I'm sorry to say sir that despite your warning a number of staff have been trying to talk to Ms Rometty in the elevator'.

Parko: 'How dare they? I want their names and badge numbers. I'll fire the bastards.'

Drone: 'Er. There's rather a lot of them...'

Parko: 'OK. Gimme a list of who didn't defy the order. I'll give them an extra bonus.'

Drone: 'That probably won't cost a lot sir'

Parko: 'Ah... OK. Gimme a list of everyone who didn't try to pitch to her in the elevator. They're fired.'

Um, excuse me. Do you have clearance to patch that MRI scanner?


...putting something like a raspberry pi in

This. You've got a multi-meeelion eurodollar device which you dare not patch for various (some good) reasons. Stick a 1,000 eurodollar firewall/ips system between the network and the device. Allow what needs to be allowed but nothing else. Nail down the config. You can patch the firewall/IPS.

Yes, I know a Raspberry Pi does not cost 1,000 eurodollars but it must be in a case with a fancy logo, right?

Edit: Should have read more of the comments before jumping in - the point's been made further down but earlier.

National ID cards might not mean much when up against incompetence of the UK Home Office


They've destroyed Capita!?

The article caused me to choose to visit https://www.gov.uk/guidance/identity-cards-and-new-identity-and-passport-service-suppliers#cancellation-of-the-national-identity-register where I found this:


Cancellation of the national identity register

The national identity register was destroyed on 10 February 2011. The personal details of everyone issued with an identity card which were recorded on the National Identity Register were securely destroyed. This included photograph and fingerprint biometrics. The register was destroyed by IPS along with the relevant contractors to approved security standards. The completion of the decommissioning will be reported to Parliament.


I got all excited. That'll learn 'em.

Universal Credit has never delivered bang for buck, but now there's no turning back – watchdog


NI Hypothecation...

...can not work. Unless you're prepared to take the line of cutting welfare to never exceed the NI tax take.

If the economy is going well and employment is high the required welfare expenditure is reduced and the NI (and other taxes) paid into the Treasury are increased.

If the economy is not going well and UNemployment is high then the required welfare expenditure is increased just at the time when NI (and other taxes) paid into the Treasury are reduced.

Every bloody gadget in the house is ringing. Thanks, EE


"a cold caller, telemarketer or spammer"

There's a difference?

Aussie bloke wins right to sue Google over 'underworld' images


Re: But

*If* he was it's probably not a good idea to annoy him...

Boffins quietly cheering possible discovery of new fundamental particle: Sterile neutrino


Re: This is not making physics any easier

Niels Bohr was more eloquent: 'If quantum mechanics hasn't profoundly shocked you, you haven't understood it yet.'

But 'batshit crazy' is probably what he meant.

Max Schrems is back: Facebook, Google hit with GDPR complaint


I sincerely hope...

that Facebook attempts bully-boy tactics by threatening to withdraw their 'service' from EU countries.

It probably won't happen but I can dream.

I wonder if the eventual outcome will be a paid-for (with money) service?

IPv6 growth is slowing and no one knows why. Let's see if El Reg can address what's going on


How to make the move?

My ISP (Plusnet) is IPv4 only.

I run a number of different IPv4 RFC 1918 subnets at home on different vLANs and/or WiFi SSIDs (as I used to for my work). I have a 'services' subnet for things like e-mail, LDAP (VM) servers, I have a 'Home Entertainments' subnet, a 'Guest' subnet (for visitors' phones etc) and a 'DMZ' for world accessible services like web, XMPP and IMAP. Part of the security of the set up is that servers in the DMZ can only reach the 'services' network through my pfsense firewall ruleset.

Sure I could turn on IPv6 for all this kit and I could use my Hurricane Electric IPv6 address block and assign routeable addresses to everything I need to - but unless I subnet my IPv6 block to mimic my internal IPv4 setup I effectively 'flatten' my carefully built multi-vLAN configuration. If I have to mimic the subnetting to achieve the same control over routing and packet filtering then there is little advantage to enabling IPv6 - apart from self-education and being ready to turn off IPv4 eventually...

As far as I can see, there are two ways way for a business network to move to IPv6:

1) subnet their address space to mimic IPv4 which seems like a lot of effort to achieve the status quo.

2) rip and replace.

There would have to be a major benefit to risk option 2 IMO.

Whatever you want (sorry - if you've now got an ear-worm).

Biometrics: Better than your mother's maiden name. Good luck changing your body if your info is stolen


Re: Biometrics

"Biometrics are your USERNAME, *NOT* your PASSWORD!!"

Hmm. I have more than a dozen different e-mail addresses which are used as Usernames to log into different sites. I have many more made-up Usernames for other sites which then link back to some of those e-mail addresses.

I only have the usual eight fingers and two thumbs and one face (no digital accidents so far).

I don't want to assert the same Identity at multiple sites. ZoOm seems a backward step to me.


Biting the hand that feeds IT © 1998–2019