Posts by Mike007

Re: Bad Rust code was the problem...

I think the sentiment is that it was rewritten because they wanted it to be rust, and without that motivation they would be running the previous version... Overlooking the fact that presumably the previous version had some significant issues for them to conclude that the solution was to put in the resources to rewrite from scratch?

I do wonder how much of it the "rust is amazing" stuff comes from people whose argument was actually "You have been refusing permission to rewrite from scratch, so how about we migrate to rust instead?"

Re: Too much money to spend

We had a junior employee whose role included doing the research and proposing suitable equipment for one-off projects.

I was given approval to purchase myself a new laptop when my position was officially changed to a developer role, as at the time I had an old MacBook that was struggling with some of the more demanding stuff.

Above mentioned employee was twiddling his thumbs that day, so I suggested he could help do some googling for a nice professional looking i7, 32GB RAM sort of spec laptop that would look good when I visit clients as someone with the word senior in my new job title.

That was how I ended up with an i9 with 64GB RAM, 2TB NVMe drive, and 4k touch screen.

Shortly after this, I was tasked with seeing what spare parts we had laying around the office. After checking the specs of a system sitting on the shelf collecting dust, which had been purchased for a one-off event playing a single 512x512pixel video stream, I went and gave our main proxmox server a significant hardware upgrade for zero cost... And his purchase proposals started getting more scrutiny!

Re: So now we know that cyberattacks cost ...

Lots of corporations do put funds in to the problem.

They purchase something called "cyber insurance".

As long as they have a cyber security essentials certificate to go with it they are all good and can tell everyone they are fully protected from cyber threats.

At a recent employer we had a little "ritual" whenever a client needed to renew their cyber security essentials certification. The relavant manager would call me to let off some steam by ranting about the latest bullshit questions from the assessor. When they were done I would ask "Did they add a requirement to encrypt laptop hard drives yet"? They would then answer: "No, which is why all of our clients can say they exceed government cyber security certification requirements."

Re: Password rules make for weaker passwords

The UK government has been officially telling companies not to do that forced password change crap for at least a decade, likely longer. (When I looked in to it the oldest version I came across was GCHQs cyber security guidance from a decade ago, the last version before responsibility for issuing such advice was transferred to the NCSC)

When you see an IT department that requires password changes "for security reasons", you can officially tell them they are even less competent at IT than the UK government! ;)

Re: Unity drove me to Mint/MATE

Same.

I describe mint as the fixed version of Ubuntu. Because I started using it when they made Ubuntu completely unusable.

I don't know what their current UI is called, but last time I looked at desktop Ubuntu they seemed to have replaced that single tasking UI with a newer, still single tasking, UI.

Fedora etc have also done that single tasking UI crap. I think it is the entire GNOME project that has been replaced with a single tasking default UI???

It's like these UI designers think the primary use case for a computer is to have a single browser window open, and probably complain about being forced to include a hidden method of opening a terminal window at the same time... The sort of people who think you can make expensive purchases on a phone, right?

Re: The question is...

I want to know how the keyboard and mouse are connected to the system they tested this one on...

Re: Snoopers charter

Send a GDPR request for all data held about you. The request by itself will result in some underwear changes.

If they have collected this kind of data without explicitly informing you, then fire off a quick email to the information commissioner...

Of course the sort of employer who thinks they are allowed to monitor what employees do without explicitly telling the users all of the data being collected, are likely to get screwed over by the mere fact that they probably also didn't register with the ICO in the first place... (It is literally not possible for a limited company to operate without being registered with the ICO - not unless they don't know the name of the director(s) and are utterly clueless about who they employ? but there are a lot who are not registered... And apparently nobody working for the ICO has thought to go through the companies house register and start mass-mailing fines...)

I got lucky. I was at home putting packets in to the tubes when they stopped working. I looked out the window and saw a van parked outside with Openreach written on the side. Walked outside and saw the cabinet was open with a bloke in high-viz, so went up to him.

"Hi, My internet just went down, is that something to do with whatever you are doing?"

"No, shouldn't be... Unless... I did just rewire a spare line, but it wasn't an active one because there was no dial tone"

VDSL/G.Fast have the internet delivered by the cabinet, but the line continues back to the exchange for POTS service. It would appear I had no POTS service for an unknown amount of time, hence no dial tone on the line...

Engineer reconnected my internet then and there, I had to raise a fault report with my provider to get a dial tone reinstated to prevent it happening again.

If I had not seen the openreach van and taken immediate action then not only would it have taken days for an engineer but when they did come out and find my line disconnected they would have been unable to fix it. There were no more spare lines to the building... (The customer he was "borrowing" my line to hook up had to wait a month or so for someone else to come out and run some extra lines)

I prefer the photos on Paula's machine...

Don't worry, I'm sure you'll find someone who likes your photos eventually. :)

I try to trick people in to voting LibDem using a complex psychological tactic that some may consider an unethical form of manipulation of the less cognitively gifted. I ask if they would like the right to end their complaints about government policy with the credibility-enhancing phrase "and that is why I voted against the bastards".

Of course it could backfire if the LibDems adopt this as their official campaign strategy for the next election.

Obviously a 2D chess player...

If an airline loses their IT systems and has to cancel all flights, they have a major PR problem. When every airline goes down at the same time because an AV vendor pushed an untested update, they just take a small hit to their short term profits. People don't even really blame them for the fact that they are still offline a week after everyone else has fully recovered.

This is why 3D chess players put their eggs in whatever basket everyone else is using.

Re: No, the opposite

> This case is likely to turn on arguments about what "fair and reasonable" pricing is. The lawyers will have a lot of fun with that.

You can ask 1 lawyer and get 2 answers.

Are you discussing the unpaid invoice someone is suing you over, or the invoice they will be sending you for getting you a discount?

The US Supreme Court has already ruled that not looking white enough is a perfectly valid reason for a van to pull up, a group of people wearing balaclavas to jump out and grab the not white enough person, bundle them in to the van, and speed off...

A normal judge heard about them doing that sort of thing based entirely on "that person over there looks Latino to me", and issued an injunction. Trump asked his pals at the supreme court to to overturn it, which they did.

I wonder if the reason they did that was because the lawyers reminded the supreme judges of a previous ruling they made where they told everyone that the president has immunity if he were to order the military to execute a judge for not doing what they are told?

Re: Very nice but

Pfft. I use butterflies.

Worth keeping in mind that most of the people on the internet live in a country where they have had mandatory ID their entire lives... And are confused why those people from the UK and US think it is a problem.

In the UK people with no intention to ever drive still need to register for a DVLA ID card for practical reasons. Except, this database isn't very useful as an unofficial and not technically mandatory database.

Re: "a US-led plot to discredit it and sully its peaceful intentions"

I have thought long and hard about the tricky issue of how to achieve world peace, and all I need to make it happen is bigger guns...

I think that's how it works?

Re: Super helpful...

There are IT teams who still use those? Did they fix it or something?

For maximum user-torture combine roaming profiles with computers that are re-imaged automatically every night, so you can't even get around the "your profile is in use on another computer" error by using the same computer you used yesterday.

Entra + OneDrive is the WORKING version of roaming profiles. Unfortunately these are tied to a Microsoft subscription...

Re: Shut up & eat your broccoli

He doesn't care about those "vote" thingies any more...

Re: Virus produced by nation state ...

Is politician a race, or a species?

Re: But why?

I agree with the general sentiment, however if we are talking about office workers then the only reason they have Microsoft Office in the first place is because LibreOffice isn't able to reproduce all of the rendering bugs required to correctly handle word documents. Word for web is even less compatible!

I had some "job seeker specialist" reformat my CV a while back, she sent a word document. I could open it in the desktop version of word, but as I didn't have a license it was read-only. I tried using the free web version of word to edit it, but the formatting was completely screwed up. Using the web version to export to PDF rendered correctly, but obviously I couldn't actually edit the document without also breaking that.

My CV is now an easy to update "HTML document", wrapped in a HTML-to-PDF script. This is a solution where readers of this site are more likely to consider it "easy to update" than your typical office worker.

Re: OpenAI says models are programmed to make stuff up instead of admitting ignorance

Managers are in a more senior position because they are simply better than the people below them.

Shut up about this bullshit from the "real world" where it's a bad idea to promote your good workers in to a position where they aren't doing the job they are good at.

One student already had a reasonable idea of what they were doing to figure out they just needed to cut a wire/short 2 contacts/whatever the payment terminal does to tell the machine to operate.

1199 students learned that there is no point trying to fight "the system". They will tell people the story about how someone at uni figured out how to wash their clothes for free, so the owners of the machines went and closed the place down. They will tell people about how "the system" would rather nobody wash their clothes than allow such things to be done without payment. They will end this "lesson" with a humourous note about how the company was so incompetent it took them a couple of weeks to close the place down, so at least they managed to get a couple of free washes.

Linux has a massive problem with the whole way drivers are embedded in to the kernel. Sure, in theory you can have external modules but anyone who uses ZFS should know this is not the same as the way windows does it. I consider ZFS to be stable enough for production use as a driver, but the fact it is an external module means it is not safe to use on a production server that you expect to actually update from time to time.

I have a surface pro. A lot of the hardware is not supported in the mainline Linux kernel. This means I need to install a Linux system with "just enough hardware kind of working to be able to get through the install process" (on most distros - some have a kernel that can not manage the install process without locking up) then post-install follow complicated instructions to replace the kernel with a forked version that does have the right drivers.

What does this mean in practice? It means after following distro-version specific instructions which might not be available for the new version, I also need to override the OS update mechanisms so it doesn't try to "update" to the "official" kernel release, which totally breaks my system.

There is working open source code for the hardware, but for various reasons they don't want every single possible driver in their codebase where they have to maintain it. Fine, then I guess we should go the module route?

If you run ZFS on Linux then you know this is shipped as a module that can be compiled against your existing kernel to be loaded in a similar way to windows... Except there is no binary compatibility. So every kernel update, you have to recompile any such modules locally to build a new version that works with the newer kernel.

There is also no source code compatibility between kernel versions, because why would there be? The only reason a module is likely to work on a newer kernel is because they don't change every line of code with every release, so most of the time you will be "lucky" that the relevant code hasn't been changed and therefore the module still builds.

Even with the work distro maintainers have put in to the automatic rebuild system, sometimes a new kernel will come out where even a popular external module like ZFS will simply refuse to build until the module source code is updated to a new version that works with the newer kernel. Not likely for less popular modules. And of course the new module is no longer compatible with the older kernel unless they put #ifdef's in and maintain the code for every kernel version they want to support.

Compare to windows land: You have a binary blob that supports windows 7, that binary will work on any windows 7 system and will continue to work as updates are released. It will almost certainly still work perfectly fine on windows 8, and 10, and 11. Most windows drivers will work just fine on any newer OS version with the only "major breakages" being 1. Pre-64bit drivers will have an issue on a modern 64bit OS. And 2. Drivers written before code signing became mandatory might be unsigned and therefore are impractical to run on a modern OS. But the basic driver is compatible and can just be installed by telling the OS "hey, use this file" with no compilers involved and a very small chance of breaking anything.

A broom and a large rug is cheaper.

We spent the rest of the mental health budget on suitcases of wine.

The main problem with benevolent dictators is that they tend to hesitate too much when it comes to the essential business of publically executing the competition.

Re: A number of Gov, mobile etc sites I use...

Nationwide have that system. However, I don't carry that stupid card reader around with me.

I do, however, carry my phone - which permits me to use biometric authentication to access my other accounts that I have with other banks that have more modern systems, should I need to transfer money etc.

Re: Easier actually.

On my networks it is, because I configure it that way. It is not the default behaviour though.

Re: Maybe they detected some type of spy activity

In the corporate scenario you give, it is far more likely that someone will walk to wherever their (single, obviously) uplink comes in and unplug it.

With this being a "we are custom coding a tool for our own use" type scenario, it is far more likely that they did a basic string match without bothering with that input validation nonsense. Then someone added a blank string to the block list or something "unanticipated" like that.

"Oh, sorry, I must be mistaken... One second let me try again. You are fired. OK did that work?"

Sarcasm is a great tool for jobs like this. Instead of it ending with both parties frustrated, they walk away defeated while you can laugh at how long it took them to give up.

Re: Power cables

About 7-8 years old I did what a 7-8 year old with a soldering iron does. Right index finger (right handed), on the bottom. Basically where I grip stuff.

That lesson was good enough that I have never taken mains voltage.

Re: Oh yuck

Sorry to inform you that there is an entire generation who probably would think asking an AI to watch a film and give them a good enough summary that they can pretend they watched it is the same thing as actually watching it.

My first thought was "but I want my wages!".

Might be a reflection on a previous employer, who I suspect would primarily want to deploy such technology for the payroll department. You know, the department where accuracy and correctness are irrelevant. Perfect for AI.

Re: Thanks for the detailed description!

JavaScript is one of the safest languages going.

You can write code with logic errors in any language, but you don't have to explicitly check "is this input going to result in RCE?" for every single piece of external data, because the default answer is no.

To those asking "what about XSS stuff?", sure you can theoretically have such issues caused by JavaScript. However generally speaking these bugs are caused by server side scripts written in a different language outputting untrusted input to the HTML, rather than JavaScript eval()ing user input which is far less common.

In this instance the language is irrelevant, they have a flaw in their logic for what conditions return a "valid signature" response.

Re: Laughable

I use the Brave search engine* in my primary browser, and Google in the secondary. So most of the time I use Brave but sometimes randomly Google. Both of them work well enough for general stuff, however they will both have that "no, that isn't what I wanted" problem. l simply try the other and will normally get the result I wanted.

I was using a temporary laptop at work today. I was on a call with a colleague and I "googled" something we were discussing. I sort of zoned out of the conversation a little, confused. Why was I getting such crap results? Took me a few seconds to spot that I had also instinctively scrolled past the normally blocked ads.

A pint (at your own expense) for everyone who immediately realised the significance of the first part. Those who didn't, try bing'ing it (at your own mental expense)...

*Brave use an independent index according to their website, the results do seem to differ from others.

Re: Why?

Because they live in a world where people are not judged by how polite they are to the cleaners, they are not judged by how willing they are to help an elderly person who has just dropped their shopping, and they aren't even judged by how well they understand the field they claim to be a specialist in. The only metric is the number of papers published. Higher number = better person = more senior position with higher pay.

You know those lecturers at universities whose job is purely teaching? Would you be surprised to find out that unlike schools there is no requirement for someone to have any kind of training to be able to teach at that level? You just need the pieces of paper saying you have studied a subject, and your salary and level of seniority will be determined based on your "academic accomplishments".

As a mature student I had conversations with several newly minted lecturers, and multiple times when they realised they "could talk to me" they suddenly directed the subject of conversation to "how well did I deliver that lecture? Because I don't have a clue what I am doing. Nobody has ever told me how to give a lecture before, help! I am desperate and I can't ask my colleagues how to do my job because they will think I am incompetent and I will be fired."

I was under the impression that a PGCE was a minimum requirement even if they didn't need full teacher training, however apparently not. The requirement is a masters degree, with a PGCE being an alternative that is considered equivalent. A head of department once told me that a masters and a paper published in a recognised journal is worth way more than a PGCE in terms of how many points your CV scores with him. ie. He literally would hire someone who has churned out a paper over someone who has actually had some training in how to teach. (Might be why I had that "same conversation" with multiple lecturers in his department???)

That is the sort of environment where people are churning out bollocks to improve their status and therefore career prospects.