Posts by Lorribot

So to recap

About ten years ago it was highlighted that these systems have laughable security if any at all....mostly the latter.

Just now, another report shows that the industry has done nothing to remediate said systems or come up with new protocols and designs that are secure by default.

You were told ten years ago and you have done nothing since and are now whinging it is too difficult because there are too many things to fix, most of which can't be and yet you still installed the same old crap systems that were know to be insecure.

If you had started 10 years ago you could be shipping proper secure systems now and it would be a start, and mitigate existing ancient systems by air gapping them or firewalling them off, wht something when you can stick your head in the sand and do nothing and get paid for it.

I still remember a conversation I had with a conveyor system supplier about patching their Windows servers controlling the system, their answer was they don't support patching and we wuold need a dev system to test on, because everyone has a dev warehouse, we were also their first customer to request 2016 (in 2019) and they didn't know if it would work or not. They also have to run their software as a logged on user on a console session or it wont work.

These systems, companies and developers have fallen in to an archaic mentality and don't see the problem. If i was hacker I would be targeting them for ransomware because I bet there are running unpatched systems and have very poor security if any just like their systems.

Choices

Option 1 buy a phone that give all your personal information to the data slurper of your choice so you can play stupid games and get harangued by work via E-mail/Teams/zoom a.n.other crummy rubbish app from the 2 gazillion on the App store because that number is important most of which also track you and record everything you say.

Option 2 buy a phone that just makes phone calls and maybe text messages. Old Nokia anyone?

"We remain committed to protecting our users against improper government demands for data, and we will continue to oppose demands that are overly broad or otherwise legally objectionable."

Good job Google have our backs when it comes to governments, now what about all those non government companies they sell my data to? Will I start getting adverts for abortion clinics if I walk past one, maybe some cold calling "we noticed your indecision as you walk past... can we help you with your life choices?"

With the limitations on track length, complexity and quality requirements of the Mobos will increase costs big time. The fact that Graphics cards barely need PCI 4, seems to me that it is unlikely to be needed in consumer PCs by 2025, servers with dense storage and the like could fulfill a need if Nand could be driven faster or another technology comes along. Main benefit seems to me to be the bandwidth which means you need less lanes, storage devices might on need 1 lane rather then 2 or 4, even Graphics cards may only need 4 lanes rather than the 16 now, however, I can't see the mobo manufactures doing the sensible thing if they can increase prices and margins.

I work for a relatively small company but we have a ridiculous number of domains (more than a 1000) and websites and certificates to manage, oddly this falls to a team that is nothing to do with web development or website management at all, got love how organic growth of IT departments mean things end up in weird places. Just getting all our certs and domains in one place was massive piece of work, and then when the great HTTPS everything hit , well cert management is 50% of someones job.

It works pretty well but you can only provide the certs, someone has to schedule in the replacement and actually do it, yes there are automated processes but these don't always work and if someone doesn't notice then....

I would imagine a business like MS renew certs at the rate of 100s if not 1000s a day so the odd one is not not a bad fail rate, who can put thier hand up and say they have fail rate of 0.1% or better?

In a past life I was a betting shop manager, pass rate for the bet settling exam was 98% (money not bets) and that was hard to live up to.

Browsers are a case of you get what you pay for.....

I have never used Chrome personally as I have never liked or trusted Google and I use Duck, duck go for searches.

I moved to Waterfox a few years ago, it is like Firefox with out the cruft. Never had any issues with any website and ublock Origin and DDGo Privacy all work well, again with a PiHole on the edge to keep the Samsung telly and Android stuff isolated (about 50% of blocked traffic).

I once used Youtube with out it all and it was unusable for me with constant ad breaks.

It always amazes me how much IT people don't care about their privacy and always recommend Chrome and laugh at my Firefox/Waterfox usage and not even using Google to search for stuff.

Other things are available, are better and load websites just as well. Don't fall for the hype and nonsense people who know nothing other than what that person on Facebook/Youtube said.

oh the paperless office (bit like fusion always 10 years away)

Despite people working from home for 2 years with no printers, as soon as people have return to the office they feel the need to print out their emails to read and keep copies of.

Memories?

Still in daily usage on Itanium where i work.

Can't wait to move it to VMware as getting hardware to work with it can be tricky. Hardware requirements and drivers have always been very specific.

Dave Cutler was involved in its conception before he moved on to NT4, Shame he never bothered to copy the Clustering in to Windows as MS version has always been on the wrong side of pants in comparison.

I would love to say this should be good, but....

...even if the EU win Apple will only be obliged to comply for EU residents which we of course or not so Apple can carry on treating us like shit as our government could not be arsed to go through the same legal proceedings as we don't have a law from 1806 to cover it.

Auto update and reboot anyone?

"these should be filtering their way down to endpoints as they update their packages."

This is why Linux is more vulnerable than something like Windows, These patches are advertised why before they are available due to the end user, so teh bad guys are handed a window of opportunity on a plate. There is nothing like advertising.

Open source developers and users need to get a handle on this stuff so they can manage it a lot better so you those windows do not open.

The flip of this is that most normal people (should Linux go to great unwashed by one of those 600 distributions) would not have a clue if their distro had this or some other (if they even cared) component/library/plugin/widget and really should just set their OS to automatically (if that is an option they can find) update everything as soon as anything is released....er just like Windows does with a little pop up to tell you reboot would be good. I am sure the Linux community would be supportive of this.

Oracle "those number things are hard"

i think the fact they only gave it a 7.5 out of 10 rating shows that Oracle can't do numbers

one rule to apply to all (OSes)

Is it possible to use any browser on a chrome book/MacOS/Android//iOS/iPadOS/Linux? Is there a pop for that? Anyone tried?

Oh of course not because everyone has chosen to send all their data and life to Google because they once said do no evil was their thing, until they beat Microsoft, now it they don't need to (even pretend to) care.

They are all rubbish and get away with it because we don't want to pay or put a bit of effort in. MS had to unpick around 33 Google services from Chromium and replace them with their, mainly so the browser would still work. Do you really think those small Chromium based browser did all that too?

Would you pay for a browser that complied with all standards and didn't send you data to any one, or even actively stopped websites stealling your data, automatically enforced minimal cookie usage. Yes? How much per year is that worth to you?

This is going to be an ongoing issue

One of the problems this has highlighted is the disclosure of this vulnerability came after the software was patched but before all the companies that used it were able to test across there own stack and provide the required updates to customers, as such you are left waiting for software patches from companies scrambling to do testing and releasing half fixes and thus the window is wide open for being hit by miscreants. VMware suffered badly as their software is external facing by design so would have high exposure..

Disclosure is a major issue with OSS components like Log4J as it is only worried about the source developers not how it is used in the real world over which they have no control or even knowledge.

On a separate note it was surprising how many companies said they weren't affected as they shipped with v1, which went out of support in 2016 and has a number of unpatched CVEs against it, v1 is even shipped/installed with SQL 2019 which was released 3 years after the software was end of life and still gets copied on to drives when you install SQL. Nice one Microsoft.

All that is good with Linux, Choice

All that is wrong with Linux "they are very likely to work, at least so long as they don't depend on a specific desktop"

Flatpack, Snaps or native?

Linux needs to stop making this stuff so hard/complicated/convoluted/clear as mud if it really wants wider adoption for the end user.

Apple has a completely closed ecosystem on the desktop, tablet and mobile, Android is more or less there and Windows just works on pretty much anything but each version is broadly the same. they all have one desktop (changed at the whim of the developer but there is only ever one for each version, except Android where Device manuafacturers/Carriers are free to make a pigs ear of things).

A small amount of choice is a good thing, vast arrays of random whimsical choices are generally not good for adoption by the mass unwashed public. Pick any industry, it will always go through the same cycle of many small companies that come together to leave just one or two, occasionally another one will pop up but the OS market is beyond that. Linux will only ever be a niche on the desktop until there is one disto to rule them all, Red Hat and Unbuntu have flattered but ultimately faltered.

People seem to think cloud services are always on 24/7 and developers code accordingly, never bothering to put something in case that free service that has no SLA just isn't available.

This always on and connected mentality even extends to developer/suppliers assuming your servers have unrestricted internet access to any web site they choose to install any python/other code are available packages from and seem to be upset/can't compute when you say, no, internal servers have no internet connection its a security risk.

No mention of it coming to Britain, Maybe Nicola might be hopeful when she leaves that it could go to Scotland when they rejoin the EU. Assuming that all happens in the time scales she would like it to happen (next week I believe).

What do mean "I" have to standardise?

If only those business decision makers actually understood what the rocky road to standardization means business processes not IT and billing costs. they may then choose not set off on that journey to cloudy niravana.

Here's to a bunch of failed mega migrations to SAP cloud just like back in day when every SAP implementation seemed to fail (thinking BA et al) once all the business change kicked in..

"I don't know what to do with it – [Microsoft's patent] looks like just the description of the standard algorithm," In that case it is pre-existing work and the patent should be thrown out stop whinging and start the process

If it isn't but affect freedoms of stuff then the system is likely broken and lets face it the US patent system has very little credibility after it allowed Apple to patent the shape of a tablet amongst many other stupid patents.

Oh and by the way just because the US patent office say yes those covering the other 95% of the worlds population may not agree.

Ooo, dark mode, now there's an idea.

Wonder if the Register will ever bother with that new(ish) fangled thing that is blessing for some with certain eye conditions. Not that i would ever play the disability discrimination card.

Beware any bundled AV products

BT offer subscriber free AV software, Amusingly the recent changed from teh much maligned McAffe to the even more maligned Norton.

You do wonder if the people that make these decission get some kind of benefit ofor annoying your customers. I assume Norton supply for free as long as the Cryptominer is turned on....

Can't wait for the 100 odd Linux based appliances that will likely need updating with patches from the many different vendors for their specific flavours of Linux, some will be quick, others not so, some will likely not bother or even know as the bloke that did has left due to cost cuts, IR35. Each one will have to manually patched, with attendant Change requests and lots of out of hours work no doubt.

Thus is the life of those supporting Linux in the real world rather the nice idealized one were you have a few servers running the distro of your choice and you can just grab and update as required.

Unlike Windows were you just point it at a WSUS server and all your servers are up to date in what ever time scale you choose.

Mainframe, decentralised, server room, cloud, edge..hmmm

Each one of these proposed a solution that fixed the problems of the previous one until that solution was overwhealmed by being used, was deemed insecure, was wrong cost model, inflexible and a myriad other things.

We could put web servers in the switches so they are close to user....no wait they are all working from home,...i know we can put a 2u server in their house that work.....

Red tape and paperwork

stopping things from happening, how long can it take to read some documents and go"hell yeah that looks ok go for it?"

Appreciate these things need to be done properly but really, what are we paying them to do have garden parties?

I am a sysadmin and it amazes me people think that because servers are virtual they are free. They completely ignore the cost of the supporting infrastructure required to keep it healthy and mitigate against borkage and stupidity.

It is the same with Open source software, its there and i can grab it and use it so there is no cost, again they completely ignore the cost the supporting infrastructure required to keep it healthy and mitigate against borkage and stupidity.

Project teams, developers and those that get paid more than you or I, often have a limited grasp of real cost of doing IT properly, in the server world that reality check happens when they try the same thing in AWS/Azure and start to see the bills come in and the Finance department can no longer say no but they will make one hell of a noise as everyone who has moved their unstructured data to the cloud after years to being the bad guy trying to keep it all on limited internal storage it was ....amusing. Now with security being number one thing, they realizing that Open Source is only free if they don't care about not being hacked.

"some of whom were American citizens"

That's a shame,

"Upon installation the code exfiltrates the victim's contact database to an outside server and installs software that automatically signs users to premium services."

That would be google then?

Apparrently it is quite easy to exfiltrate data captured from the video surveilance system via any smart tap. You just set it it to run hot water at a specified rate so you kick the boiler in to life on a regulated pattern and then monitor the heat signiture from the flue via satelite.

Sorry but that guy is a Muppet and deserves a public birching.

If he has beef with Microsoft then he should take it up with them not put the livelihoods of many people at risk because he feels a bit short changed. I wonder how many people could be victims of Ransomware because of his selfish actions. Or worse still how many people could could suffer life changing injuries or die if a hospital was attacked?

He is nothing but selfish wanker.If you don't like what MS pay go and find fault with some other company or even get a proper job and see the misery that people like you cause to the rest of us.

I really think it is time that governments made it illegal to reveal exploits in this way especially Google.

Reality check

Most people running on prem environments of any size are probably busy getting rid of their 2012 servers and will probably still have a chunk of 2016 servers that are still hanging around in 2027 so none of ths 2019/22 stuff will be of much real benefit to them for a few years yet until the majority of their systems are supported.

What would be irritating is if any WSUS replacements did not support 2016 so you had to run parralel patching solutions.

So the really annoy thing is they release an out of band patch you can only get form the Update Catalog and it is 1.6GB as it has all the patches in it that you have already applied and obviously don't need.

MS really need to stop do this stupidity. Just provide the new patch as as a standalone and FFS fix printing so I can actually patch my Print server already.

I work for a company that has around a third of staff 100% Google, the other 2/3 are O365, around 40% of all staff use Macs the rest are on Windows.

Just trying to get the Macs authenticating to AD when they only use Google services or the PCs to login and update from teh WSUS servers..... Calenders, Free busy syncs to book meeting, managing meeting rooms.

The big companies just don't want to work to common standards. they want their ring fenced customers only using their stuff.

There is no motivation on their part to make any of this work.

Look at how Google kept changing its services so they never worked as well with any other browser.

Look at all the chat apps that can't chat to each other, never have and never will.

Imagine if you were on a Verizon phone and could only talk to people on other Veirizon phones? But as it computers its all ok. Politicians need to sort this out and stop all this nonsense ring fencing and make all these comapnies agree a standard for all this stuff so they can all talk.

But I guess there is too much lobbying money in it to bother.

There is nothing like change to get people excited

There is nothing like mentioning desktops in connection with Linux to get the community excited. One persons KDE is another's Windows 8 desktop.

this inconsistency of desktops with distros changing from one to another or hacking them about shows just how far Linux is from mainstream, there is no one Linux, and never will be (which is both good and bad), for users to get behind, and in my experience if there is one thing the great unwashed user morass hates it is constant change and churn and spending any amount of time to get back to where they were before you changed things for the better.

Developers forget this and do crazy stuff and stand there blinking say but "it's obviously better and simple to use" when the user turn on them for changing stuff.

Seems like the IBM "fuck the world how do we make a profit and who can we sack" is starting to bite.

Some bits of seperating your life from Google will be tough (Mobile Phone) as the options are limited and frying pan and fire type. But we can all stop using Chrome, Google search, Maps, GMail etc and stop giving Google your data. And while you at it stop using Face book apps too.

Group of people sttting on chairs in a old church hall. "Welcome to Google Anonymous, I am a google addict, its been 30 days since i last used a Google service."