None of them currently invalidate your license that I'm aware of, but that could be used purely for enforcement of patching.

Hi Ozz,

I believe Microsoft is working on that very thing. It's already happened to PCs with a certain CPU. Don't remember exactly... :) Microsoft is invalidating Windows 7 and below on the latest CPUs and Windows 10 also as manufacturers quit supporting hardware.

Siran

---

CAPT Siran d'Vel'nahr - L L & P _\\//
Winders 11 OS? "What a piece of junk!" - L. Skywalker
"Logic is the cement of our civilization with which we ascend from chaos using reason as our guide." - T'Plana-hath

Apache wrote the bug into the software. They have done that hundreds of times. Would you buy a product from such a vendor? Apparently you would. Apparently a lot of people would. How would you explain that to a jury?

You make it sound like it was a deliberate act by Apache. "Apache wrote the bug..." Give me a break! As reputable as Apache is they are NOT going to deliberately write a bug into their software.

It is a deliberate act or are you telling the world code just springs into being without an author? It may not be intentional however. Learn the difference. BTW perfect code just springing into being is how you and many in the IT world treat open source. It is the error of IT!

As Martin says, IT is what we allow it to be.

None of them currently invalidate your license that I'm aware of, but that could be used purely for enforcement of patching.

Hi Ozz,

I believe Microsoft is working on that very thing. It's already happened to PCs with a certain CPU. Don't remember exactly... :) Microsoft is invalidating Windows 7 and below on the latest CPUs and Windows 10 also as manufacturers quit supporting hardware.

Siran

Well, it's Microsoft & Intel together.

For example, Windows 10 doesn't work on Kentsfield & Yorkfield desktop processors (Q9400S, Q9550S, etc.).
But same processor in Xeon variants work OK - check my processors X3230 & X3360.

Not to mention that both CPUs work OK on Win 8.1!
:D ;)

---

non-profit org. Play4Life in Zagreb, Croatia, EU

& the issues of installing Win 7 on AMD's Ryzen.

None of them currently invalidate your license that I'm aware of, but that could be used purely for enforcement of patching.

Hi Ozz,

I believe Microsoft is working on that very thing. It's already happened to PCs with a certain CPU. Don't remember exactly... :) Microsoft is invalidating Windows 7 and below on the latest CPUs and Windows 10 also as manufacturers quit supporting hardware.

Siran

Slightly different situation on that topic. Microsoft hasn't invalidated any licenses, rather they are preventing the latest Windows 10 edition from working on older CPUs that have been "end of life'd" by Intel. To be fair (and I know a lot of people don't like to be fair when it comes to Microsoft), Microsoft did say that they would support devices for its lifetime. Well, Clovertrail Atom CPUs are now cut off because they are at the end of their life.

So these older CPUs can continue to run older editions of Windows 10 since the license isn't invalidated, and Microsoft has announced those systems will continue to receive support on Windows 10 until 2023 (the same life they would have had if running Windows 8.1).

No matter how good technology gets & how much it is relied on, a human mind, regardless of good, bad or indifferent, will bypass it.

"The stories are being seen as a wake-up call for companies that rely on algorithms to handle the heavy lifting on their platforms - without any thought given to the potential for abuse."

Report

None of them currently invalidate your license that I'm aware of, but that could be used purely for enforcement of patching.

Took a little while to remember but Intuit does invalidate your license if you don't update. While a bit different reason than a security patch, the same effect.

As I was saying ...
https://www.techworld.com.au/article/628286/step-aside-windows-open-source-linux-it-new-security-headache/

It appears as if Linux and open source are becoming a similar security headache for companies. Ian Folau, CEO of GitLinks, which specializes in security for open-source software, warns in an InfoWorld blog that at least half of all Fortune 100 companies use Struts. He adds, “Less than 10 percent of companies are monitoring open source in their company, so even if these companies wanted to update their versions of Struts, they would have a hard time figuring out which applications were using Struts.” He believes that many other attacks will be launched using the Struts vulnerability because it will remain largely unpatched.

Millions of eyeballs, except where they count ...
https://betanews.com/2017/10/17/open-source-risks-overlooked/

"We can't lose sight that open source is indeed a clear win. Ready-to-go code gets products out the door faster, which is important given the lightning pace of the software space," says Jeff Luszcz, vice president of product management at Flexera. "However, most software engineers don’t track open source use, and most software executives don't realize there’s a gap and a security/compliance risk."

Flexera surveyed 400 software suppliers, Internet of Things manufacturers and in-house development teams. It finds only 37 percent of respondents to the survey have an open source acquisition or usage policy, while 63 percent say either their companies either don't have a policy, or they don't know if one exists. Worryingly, of the 63 percent who say their companies don't have an open source acquisition or usage policy, 43 percent say they contribute to open source projects.

There is an issue over who takes charge of open source software too. No one within their company is responsible for open source compliance, or they don't know who is, according to 39 percent of respondents.

"Open source processes protect products and brand reputation. But, most software and IoT vendors don’t realize there is a problem, so they're not protecting themselves and their customers," adds Luszcz. "This endangers the entire software supply chain – for the vendors whose products are exposed to compliance and vulnerability risk. And also for their customers who most likely don’t even know they’re running open source and other third-party software, or that it may contain software vulnerabilities."

Millions of eyeballs, except where they count ...
https://betanews.com/2017/10/17/open-source-risks-overlooked/

"We can't lose sight that open source is indeed a clear win. Ready-to-go code gets products out the door faster, which is important given the lightning pace of the software space," says Jeff Luszcz, vice president of product management at Flexera. "However, most software engineers don’t track open source use, and most software executives don't realize there’s a gap and a security/compliance risk."...

The assumed "millions of eyeballs" can make a fantastic tool or product that is freely available to be used, however, as with ANY software/hardware, people and products all too often fall foul of whatever they have bought becoming 'obsolete' or otherwise abandonware... Especially so when Marketing demand that devices and software become obsolete and 'forgotten' in a ridiculously short time...

Note that the "open source is indeed a clear win. Ready-to-go code gets products out the door faster" is very much victim to a far too common "throw the product out the door to be sold quick and to be quickly abandoned...".

Lamentable.


This is one where Manufacturers have almost no incentive to make IT or IoT devices work well.

(Especially so where ignorant over-pressured Management cut back or avoid or ignore security and reliability as an 'unnecessary cost'...)


Regulation needed? But how?!


IT is what we allow it to be,
Martin

---

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)

Regulation needed? But how?!

Not something that most would ever like, but a great AI firewall might contain damage.
But the reality is to be allowed to connect to the internet, the software/hardware combination would have to be proved. Formal mathematical proof. Of course software development cycles would return to decades long as they were back in the mainframe days.

The original idea for this thread was to show the good & bad uses of Computers & Technologies in our lives. Unfortunately, every so often, it tends to end up an O/S debate.

If it continues to occur, I'll request this thread be locked. Those that want an O/S debate can start one.

The original idea for this thread was to show the good & bad uses of Computers & Technologies in our lives. Unfortunately, every so often, it tends to end up an O/S debate.

No OS is mentioned or even applies in this case. We have the same problem with IoT (and 'cloud' products) regardless of which OS or which embedded system is used, regardless of whether the system uses 'free/freedom' or proprietary, or a mix of both. Similarly so for the too many manufacturers too quickly abandoning their IT products regardless of whether 'freeware' or one of the variants of 'open source' or whether fully fledged free-libre open source is used.

All internet connected devices need to be maintained, or be disconnected.

Whatever tool is only as good as how it (IT) is used...

If it continues to occur, I'll request this thread be locked. Those that want an O/S debate can start one.

Please post something good for our world of computers (and business practices...)?


IT is what we make of it...
Martin

---

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)

That's easy Martin, you can continue to discuss Linux in your Linux rules the world thread. For those who want to discuss Microsoft there are several Windows threads.

As for good? Do you or do you not own a mobile phone?

You must own some "form" of technology to be able to post on an Internet forum.

Computers themselves have greatly aided many in researching for whatever they are studying.

Plenty more examples out there for you to find :-)

Quite correct O/S is not in the discussion.

What is, is the human condition to find the easiest and cheapest way to get the job done for the instant. Thought is not given as to how to keep it working for decades into the future.

The problem is an accounting problem. Enterprises have no clue when their employees have yanked (right click) off the net. There is no central repository of what it is, where it came from, who will bug fix, where to find bug fixes, what bugs it has, etc. It gets worse for IoT as these are burned into rom with no thought they ever would need a patch.

Having to put the information into a database on what is being grabbed and where and how it will be supported, makes the software development cycle too long for impatient project managers and marketing types. Worse yet if that grabbed item has to be tested first to prove it is robust and doesn't just work when expected inputs are given. Anyone who tries to get control over the process is labeled and ignored.

The same applies to standards, many of which are as simply designed as possible to get the job done with no thought as to how a bad actor could leverage them against you. GPS being an example. There is no way to know if your GPS receiver is listening to the birds or a malicious actor feeding you fake data. There are far too many similar holes in standards we use everyday. Can you imagine a security hole in a standard for autonomous vehicle safety coordination? Bad actor able to intentionally crash HGV's?

I was reading an article today on the flash crash in the market. The conclusion was is was made much worse by a timing bug. As the volume of trades increased the price quote became stale (by microseconds) and that was enough for computer trading programs to kick in an swing billions of dollars. The article went on to point out how time is synced now exclusively by reference to GPS. So many things we do now require sub-microsecond timing and GPS is the only way to set all clocks to the same time. A bad actor could easily manipulate the GPS signal to move one clock a bit ahead and move another clock a bit behind and now things can be milliseconds out of sync. Chaos ensues.

I'm far less afraid of nukes than I am cyber warfare and you should be too.

---

Now you know how much $$ are at stake. The telecoms have taken to using their databases to post fake comments to the FCC
http://abcnews.go.com/Technology/fcc-stonewalling-probe-massive-scheme-involving-fake-net/story?id=51332865&cid=clicksource_4380645_6_heads_posts_card_hed

I'm far less afraid of nukes than I am cyber warfare and you should be too.

+1

---

...

Breach 2014, but it is 2017 when you find out?!
https://www.theverge.com/2017/11/25/16699116/imgur-hack-1-7-million-accounts-2014-cybersecurity

Breach 2014, but it is 2017 when you find out?!
https://www.theverge.com/2017/11/25/16699116/imgur-hack-1-7-million-accounts-2014-cybersecurity

There is no doubt in my mind that nothing is secure anymore. What to do, no idea. Har... Brick & mortar banks with no Internet connection. You physical bank there. Any Internet commerce done with bank *tokens. {* insert your word}

It's a bit like fish schools, a whole bunch of us and the sharks get a few of when they do their drive by.

From a knowledgeable relative, security keys need to be on the magnitude of two 25 digit keys multiplied to generate the 'key'.

But Quantum computers will null and void this. har...

---

...

Breach 2014, but it is 2017 when you find out?!
https://www.theverge.com/2017/11/25/16699116/imgur-hack-1-7-million-accounts-2014-cybersecurity

Actually the story is badly worded, Imgur only found out on the 23rd, that they were hacked in 2014.,