Slashdot Mirror

Hmmm... Have we ruled out Blipverts?

Or does someone have a patent on flying cars

e.g.

CC.

Before criticizing the minister too harshly, you might want to consider that the linked blog is quotes the results of Google translate on the actual press release in Italian. It's just possible that the results of google translate are a little inaccurate.

Excellent reporting. The citizen reporter is doing a great job today.

Chrome. CTRL+SHIFT+N:

You've gone incognito. Pages you view in this window won't appear in your browser history or search history, and they won't leave other traces, like cookies, on your computer after you close the incognito window.

I'm not a Chromer user so this may be hooey: Issue 94206: Incognito "remembers" Flash Cookies when Flash is open in default profile http://code.google.com/p/chromium/issues/detail?id=94206

Site facebook.com *.facebook.com facebook.net *.facebook.net fbcdn.com *.fbcdn.net fbcdn.net *.fbcdn.net
Accept from *.facebook.com
Accept from *.facebook.net
Accept from *.fbcdn.com
Accept from *.fbcdn.net
Deny

I also use ABE to restrict Google scripts in a futile attempt to keep them from knowing everything about me, but that's a more complex filter since there are legitimate non-tracking scripts they provide. Or at least I assumed those are non-tracking... Crap, now I'm going to have to figure out some redirection work around...

You know what my sure fire plan is?

Not caring. Life's too short to worry about which advertising company has information on you. Your information is out there whether you like it or not.

In todays environment, you need to understand a great deal about many OS level things, most of which revolve around security. Firewalls, mail configurations, etc. Not setting these things up correctly can have bad consequences. For example, your server IP address is blacklisted by RBLs because you left your SMTP port open and spammers started using it.

I'll respond to this with some EZ-Mode FixIt, and a small amount of snark directed at your pompous attitude.

Use a whitelist-based firewall (that is, only allow known legitimate connections (this can be per service/port rather than by remote IP, in case that wasn't obvious)). A firewall generation script can build you a good starting point, if you would prefer for it to be (mostly) done for you.

Use port knocking (look up knockd) for any "dangerous" services, such as SSH, as a further step in keeping the bad guys out of your box. No, this is not a good idea as the *only* security practice, but I have found that my SSH attacks have gone away completely from my logs since I implemented port knocking, whereas even port shifting and removing password-based authentication barely even slowed down the zombies blindly attacking my sshd (and fail2ban is useless for a distributed brute-force attack, such as the botnets that seem to do exactly that in their idle time).

Know that any decent (read: popular in the slightest) distribution of Linux will be fairly secure out-of-the-box, in that potentially dangerous services are typically not installed by default, and there are warnings about security all over the place when you attempt to install them. This means that your SMTP port scenario is an utter fabrication, because there's no mail server installed by default, and/or there's no configuration for it, so it's not running (or at least not accessible anywhere except 127.x.x.x). You are far more likely to be blacklisted because you're running it in your living room on your home's cable/dsl connection (via "public" IP range blacklisting) than because you accidentally left a port open on a default install.

But every publicly facing server should routinely delete logs that aren't central to the server's main mission. VPS and proxy servers main mission being to protect the anonymity of it's users.

Shouldn't it be considered a fraud, to advertise they you will protect a user's identity, then maintain logs which can be seized by any government agency that demands them?

reason for keeping logs:
"16:32 edit: We have had a few queries as to our logging policies. We only log the time you connect and disconnect from our service, we do not log in any shape or form your actual internet traffic.

21:05 edit: Why do we log the above^ information? Being able to locate abusive users is imperative for the survival of operating a VPN service, if you can not take action to prevent abuse you risk losing server contracts with the underlying upstream providers that empower your network. Common abuse can be anything from spam to fraud, and more serious cases involve terrorism and child porn. The main type of logging is session logging – this is simply logging when a customer connects and disconnects from the server, this identifies who was connected to X IP address at X time, this is what we do and all we do."

makes sense, they have to protect their other customers and themselves, if someone logs in and does kiddie porn or terrorism and HMA doesn't have the logs they'll lose relationships with the other VPN servers they're using. Govt might even just come in and take what servers they do have and shut down the website if HMA doesn't cooperate.

Honestly I think lulzsec was stupid for using their credit card on a VPN service for hacking online, if they thought "Let's be safe, I'll just enter my credit card number...." then they're stupid and deserve what they got. Should have gone anonymous (no credit cards, or at least prepaid) and should have gone through several VPNs in other countries.

Wanna hack anonymously? Buy a used PC, wipe the drive (or install new HD), install OS, use it only for hacking, never put any personal information on it, never check personal email, facebook, forum accounts, bank, credit card, paypal, etc. Create fake email on PC, use fake email to create fake accounts, find free VPNs and go through several of them (at least three). Wipe cookies, temp files, etc after every session. Even better if you buy a used laptop and use wifi at starbucks, mcdonalds, B&N, or open networks from wardriving and switch networks daily.

Disabling javascript as I do does better, because I can't get infested by BEAST in the 1st place!

APK

P.S.=> For example? Opera allows for GLOBAL policy sets (not using potentially dangerous things like iframes, plugins, javascript, cookies, etc./et al, 1st)...

1.) Tools menu -> Preferences submenu -> Content left-hand-side ribbon item (uncheck them ALL as to javascript, iframes, cookies, & plugins, FIRST - this creates a "global default policy" of ONLY letting those potentially dangerous things run in the 1st place on sites you frequent, or don't frequent & stumble upon/are linked to).

Then, you can set "by site" prefs to run each/any (or all) of them individually BY SITES you choose, is how/why...

AND, again - If you don't use javascript (I avoid things like ecommerce because of it in fact)? You can't be harmed...

2.) Then, for example, to make an EXCEPTION? Say on YouTube (specifically since it regards FLASH)? Right-click on the page itself... the popup menu has an "EDITSITE PREFERENCES" menu item (use it): There is a CONTENT tab (for plugins & more), COOKIES tab, SCRIPT tab (javascript), DISPLAY tab (iframes/frames), & NETWORK tab (for leaving tracking info. of a sort)).

NOW, if you NEED to use javascript for ecommerce, but are worried the site's NOT "SSL safe" vs. BEAST?

You CAN check a site's SSL/TLS level (make sure its 1.1 or 1.2 @ least) via this method in Opera:

Opera's View menu -> Developer Tools submenu -> Page Security Info submenu (outlines what type of SSL, TLS, certificates & such that a site offers, by PAGE no less).

OR, use this site:

https://www.ssllabs.com/ssldb/analyze.html?d=slashdot.org&s=216.34.181.45

(A google query for say, the Apache webserver can also help by showing you which mod_ssl level for OpenSSL is needed for it to be safe server-side too, ala -> http://www.google.com/search?sclient=psy-ab&hl=en&site=&source=hp&q=%22Apache%22+and+%22TLS%22&btnG=Search )

Incidentally, Chromium's latest builds can do pretty much the same via exceptions lists you can make, see screenshot here:

http://it.slashdot.org/comments.pl?sid=2439924&cid=37481432

... apk

Well, Ubuntu Server doesn't come with a GUI

Yes it does. http://www.google.com/#q=ubuntu+server+gui Hell, when I started typing "Ubuntu Server" the suggestion on google was GUI... And you will want the server kernel, not the desktop kernel with a few thousand threads going on.

I'd suggest that you go with one of the mainstream/common Linux server distros: either RHEL (for which you can use CentOS, which is essentially the same, minus the RedHat-copyrighted bits) or Ubuntu Server.

Either of these can be configured to use a GUI. I'd actually pick RHEL/CentOS over Ubuntu, and during the install (which is graphical), you can select to install a web+database server along with a Desktop (GUI). The installation is fairly straightforward; the most complex part is arguably the partitioning, although you can use the guided partitioner to just use all free space on the disk. Partitioning isn't something that's linux-centric, although the partition scheme for Linux is perhaps a bit more complex than what'd you would expect coming from a Windows world (dedicated swap device, LVM to virtualize the partitions, etc..). If you use the guided "do it for me" option, you can avoid getting your hands wet with this complexity.

The primary reason I'd suggest going mainstream is that the support will be there. If you choose some OS that no one really uses, you'll be hard-pressed to find distro-centric documentation for it. If you go with Ubuntu or RedHat, you can use Google to get through any obstacles you may find. There are plenty of tutorials available when you google for a simple [do this task] on [this distribution]. For example:

http://www.google.com/search?gcx=w&ix=c1&sourceid=chrome&ie=UTF-8&q=install+phpbb+on+rhel
http://www.google.com/#sclient=psy-ab&hl=en&safe=off&site=&source=hp&q=install+phpbb+on+ubuntu+server

While you could probably use this documentation to complete a task on another distro, it's helpful to have a tutorial for the specific OS you're using; all the commands will be the same, and any dependency problems, etc... will all be accounted for.

Additionally, should you decide that you want to learn more and play around, having something mainstream installed means that your learning experience will be directly relevant to anything you want to do down the line.

As an alternative, you could go with a pre-built phpBB appliance. http://www.turnkeylinux.org/phpbb is a single ISO or VDK that is built on Ubuntu Server and comes pre-configured with phpBB (they have many other applications available as well - highly recommended!). It'll ask you a few questions during the install, and once complete, you'll boot up into a fully-functional Linux server with phpBB already running.

I'd suggest that you go with one of the mainstream/common Linux server distros: either RHEL (for which you can use CentOS, which is essentially the same, minus the RedHat-copyrighted bits) or Ubuntu Server.

Either of these can be configured to use a GUI. I'd actually pick RHEL/CentOS over Ubuntu, and during the install (which is graphical), you can select to install a web+database server along with a Desktop (GUI). The installation is fairly straightforward; the most complex part is arguably the partitioning, although you can use the guided partitioner to just use all free space on the disk. Partitioning isn't something that's linux-centric, although the partition scheme for Linux is perhaps a bit more complex than what'd you would expect coming from a Windows world (dedicated swap device, LVM to virtualize the partitions, etc..). If you use the guided "do it for me" option, you can avoid getting your hands wet with this complexity.

The primary reason I'd suggest going mainstream is that the support will be there. If you choose some OS that no one really uses, you'll be hard-pressed to find distro-centric documentation for it. If you go with Ubuntu or RedHat, you can use Google to get through any obstacles you may find. There are plenty of tutorials available when you google for a simple [do this task] on [this distribution]. For example:

http://www.google.com/search?gcx=w&ix=c1&sourceid=chrome&ie=UTF-8&q=install+phpbb+on+rhel
http://www.google.com/#sclient=psy-ab&hl=en&safe=off&site=&source=hp&q=install+phpbb+on+ubuntu+server

While you could probably use this documentation to complete a task on another distro, it's helpful to have a tutorial for the specific OS you're using; all the commands will be the same, and any dependency problems, etc... will all be accounted for.

Additionally, should you decide that you want to learn more and play around, having something mainstream installed means that your learning experience will be directly relevant to anything you want to do down the line.

As an alternative, you could go with a pre-built phpBB appliance. http://www.turnkeylinux.org/phpbb is a single ISO or VDK that is built on Ubuntu Server and comes pre-configured with phpBB (they have many other applications available as well - highly recommended!). It'll ask you a few questions during the install, and once complete, you'll boot up into a fully-functional Linux server with phpBB already running.

I notice that in "Google in your Language" project, Swedish is noted as 91% finished, to bad it is also 80% really bad translation. Having mixed words and sentences in Swenglish, English and Swedish, is even worse for most Swedish users then having everything in English. Most Swedish speakers age 50-60, have a level of understanding in written English comparable to US-Americans, Swedes age 8-13 usually read English as bad/well as they read Swedish, Swedes age 13-50 understand written English better then US-Americans. So a translation to Swedish is mostly beneficial for age group 61+ and 0-7, most people in the first group have more trouble understanding Swenglish and mixed Swedish/Swenglish/English then pure English (at that age it is much easier to deal with one language at the time), most people in the second group have not learned to read any language yet. Also, most Swedes 80+ understand German and French better then English, Swenglish they don't understand at all.

What I would like to point out is:
1) The ability to speak and write a foreign language don't reflect the ability to understand that same language. A language divided into many dialects, like English(*), can often be understood better by non-native users then native users.
2) A mix of different languages (or dialects) is harder to understand (but easier to speak or write) then something written or spoken in one language (or dialect). Even when someone understands a foreign language poorly, he/she will likely understand a mix of the foreign language and his/her native language even worse, especially if it is two languages that use the same words and expressions but with different meaning (like English and Swedish(**)).

(*) Even very similar dialects of English, is as different as many "dialects" that count as different languages are, e.g BBC-English and Cronkite-English is more different then Bokmål (a standardised Norweigian dialect) and Central-Swedish (the dialects spoken in the historical core of Sweden, not to be confused with the very different TV- and Radio-Swedish, based on dialect spoken in Södermanland (where the Swedish capital Stockholm is situated) and Uppland, which is highly influenced by Hansa-German and French).
(**) Yesterday, in different contexts, I saw and heard several confusing translations of the English word director (usually translating to "regissör" in Swedish) and the Swedish word direktör (usually translating to (an) "executive" in English). Some words get really confusing, like when the Swedish word "mat", which usually translate to "food" in English (there is also the noun "föda" in Swedish, with the exact same meaning as the English noun "food"), should be translated to "meat" in English (rare and context dependent); or the other way around, when the English word "meat", usually translating to Swedish "kött" (English "flesh", but "fläsk" means "pork" in Swedish, the English word "pork" is originally from a word meaning piglet, the Swedish word "pojk" on the other hand, means a young boy (same origin as Eng. pork, but via Finnish, hence the transformation of "r" to "j"), the Swedish words "bror" and "boya" (with the same origin as Eng. "boy"), on the other hand, means "brother" and "young servant" respectively, the Swedish word "broder", amazingly, have exactly the same meaning as English "brother" ), should be translated with Swedish "mat" (food) (also rare and context dependent).

I would love to use my Bionic, headset, GV and sipdroid over wifi, currently not possible b/c of wifi interference.

It's not only possible, but the link you provided says exactly how to do it.

Pretty impressive if you ask me. Simply no helium, hydrogen or anything but basic Physics.

Next time, kids, why not start from this idea?

it's called a solar balloon
here's a video with instructions to make your own

You are guys are the reason the USA is screwed in the long term - loads of people moaning when a 17 year old or so kid pushes himself and gets something like this happening? A better place would have praised the kid, I think it's great teenagers are trying to come up with technological hacks that are new to them and dreaming great goals.

No, you're the reason the USA is screwed up. This kid did not push himself, he watched a youtube video or googled it. Why should we praise a 17 year old for doing what he saw in a youtube video?

This generation has been brought up to believe that every child is a winner. Awards aren't just given to the top of the class anymore, they give awards to every kid, no matter what they do or fail to do. Brookings Institution 2006 Brown Center Report on Education finds that countries in which families and schools emphasize self-esteem for students—America for example—lag behind the cultures that don’t focus on how students feel about themselves.

All this praise has resulted in overconfident college grads, who believe they should be given larger salaries than their peers without working for it.

So you should not praise a kid that did the same or worse than other kids else, praise should only be given when the child actually excels or achieves something few of their peers have achieved.

Yeah, that's called "the traveling salesman problem"

Odd - I call it 'Itinerary' - but that's only because my TomTom labels it as such. It's not entirely automated in that I can't specify a destination and then say 'along the route to the destination, find me X, Y and Z' - but I can look at the route it's already plotted for me and find said X, Y and Z on the map and add them as waypoints.

And if you really wanted to do a traveling salesman problem thing..
http://www.google.com/search?q=traveling+salesman+google+maps ..plenty of options to choose from for a limited number of destinations.

Of course the question becomes what is more efficient.. shortest? fastest? least turns? most highways? least highways? most traffic congestion avoidance? etc.

I would love to use my Bionic, headset, GV and sipdroid over wifi, currently not possible b/c of wifi interference.

The article link is to a scraper site that runs most of the major ad networks, from Amazon to DoubleClick to Fox. Slashdot's "editors" have been had. Again.

The article was scraped from Physorg, which scraped it from Google News, which obtained it from Agence France-Presse.

This is a commercial product called "ChildChecker", from Purple Scout.

I really doubt the pictures would matter much. I could probably get better photos zooming in with Google Maps.

Like Area 51

I'll let you zoom in on the others.

Responding to an A.C.'s hysteria is slightly less pleasurable than wiping my hemroids with steel wool, but this A.C. has some confused allegiance to the tainted bottle blonde.

Only the most simple minded would ask a fourth world refugee part time working at Fry's for technical advice. But when the part timer states, "Fry's is phasing out the selling of HP computers." Your not listening to a decision maker, but some economic slave parroting the ravings of their handler. I can't say it any more simpler, "HP optimized itself,(intercoursing with China, and India), into oblivion." HP's inability to solve manufacturing processes by neutralizing their manufacturing toxic waste caught up with them. We the public will lose a proven can-do-company, because the bottom line was decided by the likes of a blonde Cruella de Vil. The day that HP acted on, "the bottomLine > ( community || accountability || coprerateExistance )", was the day that all Sith smiled.

What's "a cumbersome install process"?

Anything that involves writing an executable to the local user account and executing it from there. Consider what would happen if /home were mounted noexec on UNIX and its clones. Windows has likewise supported disallow-by-default Software Restriction Policies for a long time.

I hate those helpful suggestions Google wants to pop up.

You can disable Suggest in your Google profile.

So where on google.com does it say "by the way, we're going to store what you search for, which links you click on, etc"?

Here: http://www.google.com/intl/en/privacy/ads/ mainly in the "What information does Google use to serve me ads?" section.

"Microsoft wrote an article about how they weren't making it harder to install Linux which described, in detail, how they're making it harder to install Linux. Here's my response" - https://plus.google.com/109386511629819124958/posts/GXc9y7E5uZX

That reminds me of when all the 'politically correct' BS started appearing - the NY police were told to call homeless people 'undomiciled'. Seriously. Apparently that practice is still in place.

Sadly, I can't tell if the first link is an honest attempt at PC 're-education' or a spoof.

One could ask if they are they less vulnerable than rats
in acquiring the resulting albumin-induced
brain damage.

You don't search too good. Try here.

Alternately,
https://encrypted.google.com/search?q=c*60ns

the speed of light * 60 nanoseconds = 17.9875475 meters

or even better..

http://code.google.com/p/nativeclient/

No major carrier offers you the hotspot feature for free (even though Android natively supports it if the carriers hadn't blocked it). You have to either root the phone, or pay the carrier's hotspot fee. In Sprint's case it was $29.99/mo with unlimited bandwidth. Now apparently it's $29.99/mo with a 5 GB data cap.

The hotspot feature works fine if you root your phone. Don't use Sprint's hotspot app - it looks specifically for a hotspot plan. Download WiFi Tether instead. There are some issues turning it on with 4G enabled - turn it on with only 3G enabled, then turn on 4G and it works fine. And AFAIK Sprint's regular unlimited phone data plans are still unlimited.

How does this attack "get to you"? Javascript! What don't I use again?? Javascript & I've advised THAT for years no less here -> http://www.google.com/search?sclient=psy-ab&hl=en&site=&source=hp&q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&btnG=Search & far longer than that (since 1997, & for security purposes).

Plus, the subject here's about this attack & the fact is, that Opera has TLS 1.2 for SSL which IS IMMUNE to it, & 1.0 is not, period... see here:

Opera implements them ALL, period!

LMAO - between my "left hand jab" with TLS 1.2 in Opera which you got so 'wrapped up in'? My RIGHT HAND KNOCKOUT PUNCH OF JAVASCRIPT LIMITING (as I have for decades) KNOCKED YOU OUT, yet again, as you continually troll me via AC replies there, "hero" (gosh why do you do that? You aren't very confident in your own words is why)!

This? Ah, I just GOTTA say it, as-is-per-my-usual style:

This was just "too, Too, TOO EASY - just '2EZ'"

APK

P.S.=> U FAIL, period, overlooking I AM IMMUNE TO THIS BECAUSE I DON'T USE JAVASCRIPT & RECOMMENDED THE SAME TO OTHERS VS. THIS HERE, AND FOR YEARS NOW... U FAIL, as usual vs. myself U trolling ac coward... give up already - you amuse me to NO end & continually make ME LOOK GOOD in doing so!

... apk

It's a troubling sign of the times, I don't like seeing brick 'n' mortar book stores going belly up, I loved to spend a few hours on Saturday afternoons looking around.

An easy problem to solve.
1) Download several of these
2) Set one of those photos as your computer's desktop image
3) Glance at your desktop background occasionally while you do your shopping at Amazon.com

You think AT&T and T-Mobile is not going to try and undercut Sprint? Why?

No reason

See Lennie & my exchange here: He showed a tool that directly determines what SSL level is being run by webservers/sites

(Servers aren't the topic here & an end user can't control THAT, except for warning sites via email, forums, etc., since its server-side & the article's about browsers, but important nonetheless).

Still - I showed other LESS DIRECT means, but they do work.

WOULDN'T MATTER FOR ME ANYHOW, I CAN'T BE "HIT" BY "BEAST" as I do NOT use javascript online & have been warning others on it for decades -> http://www.google.com/search?sclient=psy-ab&hl=en&site=&source=hp&q=%22HOW+TO+SECURE+Windows+2000%2FXP%22&btnG=Search

Mainly & obviously, because of its unfortunate "double-edged sword nature" like ANY scripted document format's been shown to be a security-risk not only online, but locally too (e.g. Office documents via AutoExec macros, or, Adobe Acrobat javascript usage by default).

NOW - You "bring up a point" though - on "servers lying" which MIGHT invalidate Lennie's tool...

So, my suggestion & method's "3rd optional step" of emailing admins of a site on SSL/TLS levels in webservers MIGHT be necessary as well IF ONLY TO WARN THEY to update mod_ssl, which in the case of my examples (/. mainly this site)? Is available.

APK

P.S.=> I have other methods I noted vs. Lennies, take 1-2 more steps, but would work just the same (NETCRAFT, GOOGLE QUERY, & emailing a site admin IF needed), for server-side (off topic though it is, it matters)...

STILL, bottom-line on what a USER can control to "proof themselves" vs this AND OTHER ATTACKS GALORE?

The topic was BROWSERS here anyhow, so I extolled Opera's "main virtues" & others here thanked me for it (since 1 proofs you completely which I noted above on scripting & the other works with PROPERLY modded servers for TLS SSL encryption (Apache mod_ssl levels, & IIS have it))... apk

1.) So you use NETCRAFT's "What's that site running" here:

  http://uptime.netcraft.com/up/graph?site=slashdot.org

To determine what webserver a site runs (what build level), first.

2.) Then, query a search engine for what webservers have TLS 1.2 in them, ala:

http://www.google.com/search?sclient=psy-ab&hl=en&site=&source=hp&q=%22Apache%22+and+%22TLS+1.2%22&btnG=Search

3.) & if NEED be, write the website on what "mod_ssl" level they use currently & warn them to update to the one that has TLS 1.2...

* Easy as pie, & even EASIER than step #3, is to just use this:

https://www.ssllabs.com/ssldb/analyze.html?d=slashdot.org&s=216.34.181.45

That last tool I have to thank someone named "Lennie" here on in an exchange he & I had today (much more direct on determining SSL TLS level used on a site than my "detective methods")...

APK

P.S.=> Funniest part is, I'll never EVER get hit by "BEAST", because I don't use javascript here "indiscriminately" (hell, I never do, I don't even do "ecommerce" because I know the security-downsides of Javascript is why)... but, time to "take you apart" in your quotes now (the FUN part):

"That won't work. The way TLS works is the client says 'hey I have 1.2" and the vast majority of servers reply, "cool, but I only do 1.0 so do that instead" and the client obliges." - by Anonymous Coward on Thursday September 22, @10:25AM (#37479622)

See the above, & "tell us another one", ok? IF you don't have javascript active (especially "everywhere + indiscriminately" though? Like myself, you CANNOT BE HIT BY IT, period!).

Care to debate that, you ac troll??

---

"Old servers reply with "error there is nothing other than 1.0" so that's why the default is 1.0 on clients" - by Anonymous Coward on Thursday September 22, @10:25AM (#37479622)

So, see the above - I provide tools to check "server-side" also for TLS/SSL levels, what builds of a webserver have it, as well as what a server runs... simple!

(Guess you didn't KNOW that, eh, troll? LOL...)

First of all, I am ONLY extolling the fact that Opera already has a few "built in/native" mechanisms for combatting this (perhaps the best is its "by site" prefs & not using potentially dangerous things like iframes, plugins, javascript, cookies etc./et al, rather than its TLS 1.2 option it already has).

---

"Also everybody APK is a troll" - by Anonymous Coward on Thursday September 22, @10:25AM (#37479622)

Ahem: EXCUSE ME, but aren't YOU THE ONE TROLLING VIA AC REPLIES + ADHOMINEM ILLOGICAL LIBELLING ATTACKS NOW?

Yes, you are... pot calling the kettle black!

---

"I did not want to feed him, but felt it was important to let others know not to follow his 'legit' advice." - by Anonymous Coward on Thursday September 22, @10:25AM (#37479622)

What's not "legit" about what I wrote last round in Opera being able to defend a user, BROWSER SIDE (the topic here mainly) vs. SSL type attacks like "BEAST"?

(Now, I know this AC troll will run from this, or go off topic & attempt more illogical adhominem attacks, but I always have fun with him, making him look more ignorant than he already is, everytime)...

... apk

Although you may be right, all that means is that in 5 to 10 years Web applications will reach the state of the art of current native applications. This furthermore assumes that the latter will remain static during that time.

So, yes, perhaps in 5 years you'll finally be able to play Angry Birds or WoW on your browser, but I would expect native applications by then to offer an even richer experience.

dZ.

You can already play Angry Birds in your browser, its one of the games on Google+ and you can play it from the Chrome Web Store: https://chrome.google.com/webstore/detail/aknpkdffaafgjchaibgeefbgmgeghloj

And here's some early try outs of Rage levels in WebGL in a browser: http://www.youtube.com/watch?v=d0S2dsuSxHw

See subject-line above & thank you for the thanks!

APK

P.S.=> I had to thank someone for supplying me a direct tool here too, in Lennie's replies in fact, for an online analysis tool he provided myself (& others) here in fact - NOT A "WASTED DAY" if you learn a new thing I figure!

His tool (vs. my 2-3 step detective work methods), saves a few seconds of work actually!

(Yes, I can do that with a couple more steps for the most part, via:

NETCRAFT'S "What's that site running" -> http://uptime.netcraft.com/up/graph?site=slashdot.org

&

A simple GOOGLE or BING query -> http://www.google.com/search?sclient=psy-ab&hl=en&site=&source=hp&q=%22Apache%22+and+%22TLS+1.2%22&btnG=Search on webserver(s) that have TLS 1.2 abilities)...

So... you MAY wish to look into Lennie & my "exchange/debate"!

He illustrated good tools are there for you to use also that combine with Opera's TLS 1.2, & "By Site Prefs" abilities (unique to Opera in fact afaik & native to it) to secure yourself vs. this threat, & identify (especially for your FAV sites you frequent most) which sites have TLS 1.2 abilities in their webservers (IF NEED BE? Well - You can email the folks here on a site too asking on their TLS level if needed, or use Lennie's tool here -> https://www.ssllabs.com/ssldb/analyze.html?d=slashdot.org&s=216.34.181.45 )...apk

Come on Lennie, you're better/smarter than THAT!

"Yes, but what does a Google query tell you about the website (thus server) you are connecting to ?" - by Lennie (16154) on Thursday September 22, @11:01AM (#37480096) Homepage

It tells you what mods or webserver builds (in the example I used, Apache) contain TLS 1.2 or what mod is necessary for it to work (you even noted which does iirc).

The articles tell you IIS has better encryption also, but NOT BY DEFAULT, you have to activate it...

You have what you need with the 2 pieces I supplied, just a touch more "legwork" (not exactly 'brain-surgery' either mind you) than your direct method is all... but, again:

I am SURE that if I can "figure that out"? So you can you, & others... using NETCRAFT's What's the site running link I supplied, & the GOOGLE query I put up after in reply to you!

E.G.-> http://uptime.netcraft.com/up/graph?site=slashdot.org

&

http://www.google.com/search?sclient=psy-ab&hl=en&site=&source=hp&q=%22Apache%22+and+%22TLS+1.2%22&btnG=Search

---

"The Google query tells you certain versions of Apache do support TLS/1.1 and TLS/1.2. - by Lennie (16154) on Thursday September 22, @11:01AM (#37480096) Homepage

Again, see the above: My 2 steps do what your site you pointed out does, not a hell of a lot more detective work is all... BOTH methods work, yours & mine, easily (& It doesn't take a "brainiac" to use either one).

---

"It does not tell you the Apache of the website you are connecting to has that version of Apache installed.by Lennie (16154) on Thursday September 22, @11:01AM (#37480096) Homepage

AGAIN, Lennie, come on man - read it closely:

NETCRAFT DOES TELL WHAT APACHE YOU CONNECT TO, see my example, look @ IT CLOSELY:

http://uptime.netcraft.com/up/graph?site=slashdot.org

E.G.=> SLASHDOT USES APACHE 1.3.42 & then you can inquire with the guys here (they do, after all, supply contact info.), IF needed... pretty simple!

APK

P.S.=> HOWEVER, the topic & ARTICLE @ hand, is browsers specifically, not servers (see subject of this article, Chrome specifically).

Thus, I supplied what others thanked me for in part in other replies, that Opera already HAS WHAT IS NEEDED, browser-side, in TLS 1.2... the bottom-line here AND TOPIC, is that above all else!

... apk

Wait, Apple declines approval to competitive browsers on iOS? Does Opera, Skyfire, Cyberspace and Sleipnir know about this? http://www.google.com/search?gcx=w&ix=c1&sourceid=chrome&ie=UTF-8&q=ios+web+browsers Still, you're right -- they're all subject to approval. But if they're not allowing plug-ins, that probably has something to do with mobile app architecture and permissions/sandboxing than whether or not they think it's 'cool,' so other browsers probably won't be able to shoehorn in something along those lines at all.

Or didn't you state this in your init. reply to me (verbatim requoting you from it in fact):

"Apache on Debian old-stable does not support TLS/1.1 on Debian stable it does. It is enabled too. You can get TLS/1.2 as well, if you install mod_gnutls instead of mod_ssl" - by Lennie (16154) on Thursday September 22, @07:46AM (#37478086) Homepage

I.E. (per your own words above & a bit of research IF necessary for knowing what servers/webservers contain such SSL encryption abilities, for those concerned unlike yourself because you KNEW some already, & about online safety) E.G.:

IF you know what the server runs OS-wise, & webserver-ware wise (which the netcraft page posted shows you)? Per your OWN WORDS above, you know "what's-what"!

E.G. - How HARD is it to make this query in BING or GOOGLE to research what TLS encryption methods are possible in webservers noted?:

http://www.google.com/search?sclient=psy-ab&hl=en&source=hp&q=%22Apache%22+and+%22TLS+1.2%22&btnG=Search

(Simply by querying GOOGLE on this quoted string: "Apache" and "TLS 1.2")

?

ANSWER = it's NOT... "here endeth the lesson"

APK

P.S.=> OR, didn't you say that above, AND doesn't netcraft's "WHAT'S THAT SITE RUNNING" NOT SHOW WHAT SLASHDOT.ORG (my practical example) SHOW THE OS & WEBSERVERWARE THIS SITE USES and GOOGLE/BING DO THE REST?

Sure they do - that's what those tools are FOR...

... apk

If you use a VPN, you should be protected from "local" man-in-the-middle (MITM) attacks. By "local", I mean between your computer and the VPN server. A VPN doesn't protect you from a MITM attack between the VPN server and the webserver you are connecting to. But it does protect you to the VPN server if you are at an Internet cafe, hotel, or other untrusted network.

At least that's true for most VPNs that use software based on OpenVPN, which uses OpenSSL for encryption. A copy of an email from James Yonan was recently posted to the OpenVPN User's list. Bottom line of the email: OpenVPN uses OpenSSL for encryption, and OpenSSL has been patched since 2002 for the vulnerability which most people think is exploited by BEAST. As long as your VPN software uses a patched version of OpenSSL you should be covered, at least for the "local" MITM attack.

For example, VPNs based on Tunnelblick, a free and open source GUI for OpenVPN on Mac OS X is not vulnerable.

I've thought about this for a long time, and nothing beats "skydiving without a parachute". Hands down.
Biggest thrill possible. Truly instant death. Zero risk of "crippled/vegetable survival".

And you don't have to climb yourself! What a deal! ;)

http://www.google.com/search?q=Surviving+Skydiving+Without+a+parachute

Whoops, of course I meant "... http://www.google.com/search?q=apple+sues+-samsung I clicked through to the 13th ..."

Hmm, yeah, first "AU Optronics Sues Samsung, AT&T Over LCD Patent Infringement ..."-like result is on 3rd page, whereas for http://www.google.com/search?q=samsung+sues+-apple I clicked through to the 13th page (Google told me that I look like a bot then, so i stopped) and didn't find one.

http://www.google.com/search?q=%22samsung+sues%22+-apple - "About 6,670 results"

http://www.google.com/search?q=%22apple+sues%22+-samsung - "About 441,000 results"

http://www.google.com/search?q=%22samsung+sues%22+-apple - "About 6,670 results"

http://www.google.com/search?q=%22apple+sues%22+-samsung - "About 441,000 results"

I've never heard it called the DOJA. And apparently neither has google.

This system isn't crushing a person to death. It is using force-induced hypoxia to deprive the brain of oxygen.

The trouble is that force-induced hypoxia is not an elegant method of death. Fighter-pilots and people who have ridden a cetrifuge know the distress caused by excessive G-force on the body.

However, a painless and humane method of hypoxia can be achieved by depriving the subject of oxygen in the air, and replacing it with an inert, non-toxic gas that does not irritate the body. My preferred method of death would be death by altitude chamber induced hypoxia.

An episode of BBC's Horizon followed a former minister on a search for the most humane method of execution. The final outcome was that the most humane method of execution was via similar method of hypoxia, which also happens to be fairly inexpensive, as well.

If this is true, Yahoo deserves to die.

It only takes half a brain cell to realize that allowing customers to opt in or out of spam checks on OUTBOUND email is a bad fucking idea.

If this is true, it would explain why Yahoo server IPs are always blacklisted at SpamCop.
Pick an article and timeline: http://www.google.com/search?q=yahoo+spamcop as many of their IPs are compromised on and off since 2007.

I thought they used those for abortions?