Slashdot Mirror

The difference is between file systems. Internal storage uses one of the UNIX file systems with extensive permissions available, SD card uses FAT which has none. While one could format SD cards with something other than FAT file storage system, it would become all but useless outside the phone. Android is requiring apps to behave, and it cannot guarantee good behavior on SD cards, because of the file system used there.

It is as much a restriction of FAT as anything. THe best thing the whole Industry should do, is come up with a standard for file systems OTHER than FAT. The problem with a new standard is ...

https://xkcd.com/927/

Then pick another comic at random.

http://xkcd.com/1210/

http://xkcd.com/221/

Oblig XKCD

http://www.xkcd.com/1358/

Once a person (man or woman) is out of school it becomes increasingly difficult to find a spouse

Randall Munroe would disagree.

https://xkcd.com/603/

Actually, considering how well water works as a radiation shield, it would kill very little of them.

hearbeats just exposed their faulty malloc replacement.

Heartbleed had nothing to do with their malloc replacement (at least not directly [*] ).
Heartbleed is just a very basic case of missing nested bound checking. (They check bounds for the heartbeat request it self, but fail to check is the super structure containing the hearthbeet - i.e.: the packet - passes the bound checks too. XKCD's explanation is actually spot-on: it's more or less equivalent to forgetting to check if the requested number of caracter doesn't exceed the size of the speachbubble).

This is not caused, by memory allocation system. This is caused by several factor, among which the fact that heartbeat are a very stupid design to begin with.
(Reasons:
- there are already other better way to keep a connection alive
- totally free payload and payload-size are a bad idea (why not simply use a fixed size 32 or 64 bits ID) ?
- specifying the payload's size is stupid, because there's already a size limit: the packet itself. Now instead there are 2 sizes to check and such redundant work often leads to errors as it happened with heartbleed)
But TLS/SSL are very convoluted, to the point that someone might ask if these standards aren't designed on purpose so someone could fuck them up. It's almost a long series of "exploit-bait" engineered into standards.

---

[*] : instead of concentrating on replacing malloc, they could concentrate on replacing another part, namely designing buffer-types that contain buffer-size and are automatically bound-checked.
So heartbleed has something to do with their in-house memory management, in that they lost the opportunity to bake automatic bound checking into their custom memory manager.

That is dumb. Less information. I want to have everything crisp. I want to see everything I can. Not some artsy bs. Damn hipster old notalgic tech bullshit.

You may need to replace your eyes then https://xkcd.com/1080/

A previous "fix" of OpenSSL left it more insecure than it was. Just be sure to understand what you are modifying, and why even an "obvious" error was appropiate there. I suppose that also xkcd is relevant here too.

100 pounds of enriched uranium is a lot.
https://xkcd.com/1162/

obligatory: http://xkcd.com/941/

Perhaps for programmers the need is not evident, but for anyone who writes long documents, it's indispensable. It's indispensable enough that I am still using Microsoft Word for anything that has any sort of header/subheader structure. OO and LO are OK for short letters and memos, but if it has more than 2 headings it gets clunky because of the lack of outline mode.

The core difference between writing text and writing code, which apparently the programmers working on OO and LO fail to grasp, is that writers are producing text which will be read by humans, not executed by machines.You can't just comment out the cruft and do a GOTO jump over that module you decided you don't want, then tell them to go back 17 pages to pick up the information in paragraph 3. Writing needs structure and flow to lead the reader through the material in a way that make the content comprehensible. It needs primary and subordinate ideas. Order and levels of importance are important. In Microsoft Word, collapsing the document into Outline mode and seeing the heading and subheading structure makes the flow of the document visible, and more important, the means to change that flow is on the same screen. There is no interruption in the work flow.

http://www.gigamonkeys.com/code-reading/ seems to understand it, going the other direction: most real code isn't actually in a form that can be simply read .... in order to grok it I have to essentially rewrite it. I'll start by renaming a few things so they make more sense to me and then I'll move things around to suit my ideas about how to organize code. Pretty soon I'll have gotten deep into the abstractions (or lack thereof) of the code and will start making bigger changes to the structure of the code. Once I've completely rewritten the thing I usually understand it pretty well and can even go back to the original and understand it too.

Which leads me to "Issue 3959", wherein writers asked for this on 2002-04-10 20:39:19 UTC ... it's ranked as "Trivial" now. It has nothing to prevent implementation except the inability of the code maintainers to accept that writers really do know what they need in their tools.

Here's the overview of Bug 3959 ... https://issues.apache.org/ooo/...

OVERSHOOT wrote upstream: Ah, yes. Issue number 3959. Originally filed April 10, 2002. More than twelve years ago. In that time it has remained in the top-voted issue list year-in and year-out. Others come and go, but 3959 keeps on pissing off users. At last look, there are about ten duplicates requests on file.

Every few years some developer wanders by and tells the people following it that nobody needs outline view, or that there are tools available to do it, or whatever. Often, they close the issue. In effect, "I don't use outline mode so obviously it's not important." The mailing list heats up for a while, the developer either mumbles something about maybe the team should look into it and vanishes or else just vanishes, but the issue is either reopened or left open. I've seen at least four of those cycles so far. We're probably due for another one.

At this point, I suspect that 3959 will outlive (Open|Libre|Star)Office for the classic open-source software reason: if it doesn't scratch a developer's itch, it ain't happening. And apparently, developers don't outline, edit, or otherwise structure their writing or much care about the people who do.

As the wisdom of XKCD proves - http://www.xkcd.com/619/

Seriously, for performance reasons this dev-team bypassed malloc of all things; do you really want to assert that they wouldn't have bypassed a bounds-checker?

How would they have bypassed the bounds-checker? About the only way would have been to say int[] all_my_programs_data = new int[1000000000] and then write an interpreter for their own language that uses that array as its data store!

Let's take the example from XKCD: "HAT (500 letters)". To read past the end of the "HAT", they would have had to manually copy that string to some communal store, like all_my_programs_data, and then read past the end. Aside from completely ignoring the language runtime and implementing your own on top, in a language with enforced bounds checking you would not have been able to read past the end of "HAT"!

I've only clicked on your reply a couple minutes ago, but aside from "change the language runtime to no longer enforce bounds checks", I literally cannot think of any other way you would bypass a language's bounds checks.

Everything else, like overruns, overreading, etc is a result of that decision.

No it isn't! It's almost entirely orthogonal!

The OpenBSD malloc that they bypassed makes exploits of already compromised programs harder; that's why Theo refers to "exploit mitigation". If OpenSSL didn't have the overread to begin with, the fact that they replaced malloc would be a questionable decision but wouldn't have led to any exploit. And even with a hardened allocator (or most hardened allocators, anyway), the exploit is still there, it's just much harder to get anywhere near as much confidential information.

That's the only way that they aren't orthogonal: the two mistakes reinforce each other on OpenBSD. In all other respects, they are completely independent.

" just about every SSL-encrypted internet communication over the last two years has been compromised."

Just every OpenSSL one has. In the case of, say for example, Hiawatha, it has SSL- but it doesn't use OpenSSL. It's Internet communcations hasn't been compromised. Same way with IIS.

The problem isn't even the code. It's an "innocent" feature in a security piece of security software that's an ease of use thing, really.

XKCD basically spelled out the problem even.

You don't design things like this into a security software to begin with- and a *DESIGN* review should've been done to it starting from the notion of is it even a good idea to begin with, not is the code "fine". Sure, you SHOULD make it relatively easy to use- but an ease of use feature should be thought through for soundness before anything else. Does it present an attack face? Once you answer that as a "yes" (which this would've...)- you ask yourself is there ANY buffer overflow potentials (you don't offer lengths, etc. An are you there or similar feature or the like shouldn't have *EVER* provided a user controllable knob. Just a reply. This flunked on the length score out of box.

This failing would've happened in a FOSS context or a closed one. To say that the onus is on checking for this stuff in a closed source shop is LYING to yourself and others. To say that it's prevented in a FOSS project because all eyes make the bugs become shallow...that too would be LYING to yourself.

FOSS caught it out quicker and it got fixed vastly quicker because of the oft quoted remark about bugs. How it happened? Pure and simple sloppiness combined with the wrong-headed notion that Security is a Technology and the like. Security has tech as a component. But it's more of a philosophy and way of viewing everything. This crap, if you were security conscious would've been a red-flag. Not the code that "innocently" produced it (sorry...not buying the author's take on this...he's very much at fault as are any of the others that even thought the feature that allowed the "innocent" mistake in...)- but the original feature that allowed it to be "oopsed" in the first place. It should've flunked the sniff test at the stage it was conceived because there's no good way to guarantee the implementation being safe and properly secure regardless of how it was implemented.

Yep! Total chicken and egg problem though perhaps not an unsolvable one. You'd basically have to make something that is easy to start and easy to use and falls back gracefully for customers not using it yet. Plug in to popular accounting software packages and maybe a web interchange.

The standardized format part appears to be a solved problem. The Wikipedia article on EDI is rather sparse, but the standards evidently do exist. Rather too many of them, I'd say. Which one is actually likely to be useful for the majority of people? I can't tell from the article. (And naturally there's a gate-keeping committee who thinks they can charge $850 for ASCX12. What a joke.)

Extensions to QuickBooks does seem like the logical route to take. However, I personally have no interest in running a web interchange, especially since EDI via email and FTP are standardized. Given my allergy to "screw the customer as hard as possible" business models, I'd sooner write a system that takes advantage of communication systems businesses already have, rather than try to collect extra.

xkcd.com/1007

Funny that say "20 years"; winters like this were pretty common before that, so your statement actually supports AGW. Obligatory XKCD.

Also, "North America" != "the world". While you and I were having a brutal winter, it was unusually warm in other places.

Oh hell, they'll just sneak into your home in the middle of the night and plant a hardware bug or key logger into your computer.

One of their favorite tactics used by law enforcement is to install cameras in your residence facing where you normally use your computer. They got a child pornographer like this, his use of true crypt didn't help because they had video of him entering the password and simply entered the password once they seized the computer.

True Crypt cannot reasonably protect you from law enforcement nor state sponsored spying like the NSA. It might protect you from some non-tech police agency in some shit hole country being able to access it but then they just use the standard non-tech password extraction method.

Obligatory XKCD. http://xkcd.com/538/

It's random enough.

Strength in numbers.

That, and picking journals and disciplines with a somewhat less effective peer review process; see here and my reply here.

?? Confused here ... so are you saying that you HOPE he CHANGES?

That being said, he's "at the mercy" of what his managers tell him. I'm sure news is filtered every which way but loose and that he's told "ignore the TV", as those guys only reflect some public opinion, and they don't have all of the facts anyway.

After all, we know he's proficient in technically matters, so I'm sure that him deep understanding the NSA technical functions is just obvious.

Hmm, maybe what laws need is included comments...

Laws have comments. Things like introductions, framing statements, etc. In fact there's an art to reading laws in order to separate the "code" from the "comments", in order to get to the stuff you need to know. And then the specific laws have whole libraries of case-law, regulations, and other dependencies which you need to know in order to apply the "code" to a specific situation.

But programmers CAN become politicians,

Technical people make terrible politicians. Some can become good technocrats, in a non-democracy, but generally not good politicians.

Software developers have experience at building systems that need to be useful, flexible, but difficult to exploit.

Oblig

https://xkcd.com/1354/

oodaloop is not in the sudoers file.
This incident will be reported.

Just watch out for this:

https://xkcd.com/1319/

Either way, you'll have a lot more fun maintaining the script than you would doing the same boring task over and over :)

Just watch out for this:

https://xkcd.com/1319/

Relevant XKCD: http://www.xkcd.com/1352/

Be grateful you made it back to this thread in under two hours. I am just now making it back after three days. Obligatory.

What I meant, and I'm fairly sure it wasn't as hard to understand as you make it out to be, is that you do not refrain from raising a true point merely because it seems to weaken your case.

If you do so, your best case is that you will be ignored, and your worst case is that you will be no more right than the people you are arguing with. Constraint yourself to making any and all relevant true points, and then pick up your opinion so that it is still correct. Otherwise, how do you know you are right?

Shachar

The longer you spend arguing with an idiot, the higher the chances he's doing the same thing.

Oh yes. It was right here.

Dude! Who said these "foundations" need to be make from, say stone? Just because someone is to daft to imagine gravity, does not mean God could not work it out. For the Sun bit I also have an obligatory XKCD: Centrifugal Force. Just because someone is also incapable of doing coordinate transformations, does not mean God can not do them. In addition, the Psalms are "just songs" and as thus are at maximum "inspired" and not divine word as such, in contrast to for example Genesis.

Why the hell does an atheist need to point out their narrow minded interpretation of the text?!?

When I was a child, I talked like a child, I thought like a child, I reasoned like a child. When I became a man, I became an atheist.

Oblig xkcd:

http://xkcd.com/558/

First, future generations may find of historical interest all those NSA records. Just think of all the data historians in 100 years (if humanity still exists) will be able to use for PhDs! And I'm only half joking about that.

The deeper issue relating to "prison" is more, is what we are doing effective? With a huge relative-to-population real prison and parole population in the USA, with vast numbers of people living in relative poverty, with thousands of nukes ready to destroy the world as we know it in a few minutes and related anxiety, with schools increasingly like prisons, and so on, one might argue the USA has already become its own anxiety-provoking prison for all too much of its population. Perhaps that's one reason for the US drug war -- while the Soviet Union had to guard its borders from escapees, the USA has to guard its medicine cabinets from escapees? (See also Wikpedia on "Rat Park".) There used to be a time when people in the USA aspired to more than that, and in that sense the USA is rapidly heading into a "Dark Age". From:
http://en.wikipedia.org/wiki/D...
"Dark Age Ahead is a 2004 book by Jane Jacobs describing what she sees as the decay of five key "pillars" in North America: community and family, higher education, science and technology, taxes and government responsive to citizen's needs, and self-policing by the learned professions. She argues that this decay threatens to create a dark age unless the trends are reversed. Jacobs characterizes a dark age as a "mass amnesia" where even the memory of what was lost is lost."

I agree that pervasive one-way surveillance in a society shifts the balance of power, which is the reasons for US constitutional protections relating to search and seizure of documents. One can contrast that with David Brin's two-way "Transparent Society" idea, or Marshall Brain's similar suggestions in "Manna". Historically humans living in tight-knit tribal villages may have not had much privacy from each other in many ways, so our very conception of privacy via anonymity and hidden transactions or hidden records may be a new thing. In any case, these are somewhat different times from 100,000 BC or 1776 AD given cheap storage, cheap sensing, and cheap search. There also the unreliability of cryptographic systems in practice (OpenSSL bugs, spear phishing, MITM, key loggers, evil upgrades, provider compromise, and so on), so depending on encryption seems problematical, assuming hiding information really had social value in general in social movements. I'm not saying privacy is evil; I'm just suggesting that depending on privacy in a social movement is probably foolish at the very least for practical reasons. Beyond practicalities, I feel the way forward has more to do with popularizing good ideas (like about the potential for abundance for all such as by a "basic income") rather than trying to hide plans of whatever sorts from prying eyes. In the USA and many other countries we have hard-won democratic freedoms like freedom of speech and freedom of assembly. I feel it is best to use those freedoms to build something better, even knowing such efforts for change will be under constant public scrutiny. The problem is of course that building something better is hard work filled with a lot of uncertainty, including from resistance put up by those with a powerful position in the status quo or those who aspire to such a position. See also, on "Security: Crypto Imagination vs. Reality":
http://xkcd.com/538/

There is a scene near the end of James P. Hogan's "Voyage From Yesteryear" where a soldier makes a silent plea for sanity with another soldier at a command post by how the soldier moves and carries his equipment, and that is something to think about. What signals do we send others when we focus on encryption as a way to security rather than focusing on broad social and material uplift? I'm not saying there is not conflict there, just that we can look to a parallel ar

Did somebody say Obligatory XKCD?

Congratulations. You're one of today's lucky 10,000.

obligatory XKCD

Why do you think the Programmer wouldn't care about you personally? How do you know what such a being cares about?

Consider a game of SimCity. Do you not care about your Sims? You do on some level. You create a place for them to live, you try to take care of their needs, but they do have a "mind" of their own. If you believe in the simulation argument, what do you think the motive of the Programmer is? Can you even know or comprehend?

Perhaps the Programmer is running a moral simulation. Can I create a perfect world, have it fall from perfection due to the actions of the simulated beings, and then by showing them an example of perfect love and sacrifice, see if these mere simulated beings can recreate paradise? If so, Jesus Christ was his avatar on Earth, and Christianity is true.

As far as the computational requirements of simulating this universe, again, we have no idea what the capability of the Programmer's computer are, but we also have no idea how fast simulated time runs compared to real time (assuming there is even such a dimension as time in the Programmer's reality). Oblig. xkcd. It's also quite likely that the simulator has some cycle-saving features, like instituting a maximal speed limit so regions of the simulation computed in parallel can be guaranteed to be independent, or abstracting objects that are much smaller than those typically observed by the simulated intelligences unless a simulated intelligence is closely observing those objects. Suddenly relativity and wave/particle duality are emergent properties of cycle-saving programming optimizations.

I don't discount that we may well be living in a simulation. It makes sense to me. But I am also Catholic, I believe in Jesus Christ, and I believe in God, who may well prefer to be called Math-Maker, Programmer, or simply I AM. Maybe when this simulated body dies, my simulated consciousness will get to meet the Programmer.

Luckily they never made a sequel.

the obligatory ref https://xkcd.com/566/

But any time a scientist (particularly a theoretical physicist; they're especially prone to that) claims, within minutes, to revolutionize a different field of science in which everybody has apparently been wrong for decades, this should be taken sceptically. Obligatory xkcd: https://xkcd.com/675/

Relevant xkcd

http://xkcd.com/793/

The really interesting thing will be when Randall does a comic about how you can get easy upvotes for "oblig xkcd" posts.

https://xkcd.com/1150/

Oblig. https://xkcd.com/1244/

It would be tolerable if these people were just conspiracy nuts ala the "moon landing were faked" folks. We could laugh at them and move on with our lives. These people, however, are in seats of power in the government and are making big decisions about scientific funding.

Oblig. XKCD

I know they're cheating when they use names like 001l0l1O1l, they don't want to be reported.

And the obligatory comic from:

http://xkcd.com/154/

Crypto is being supplanted by a lack of rights.

Ob. XKCD:
http://xkcd.com/538/

Now a days you don't have to worry so much about some criminal beating you with a wrench, however you do have to worry about the NSA going to everywhere you actually store information online and forcing them to give the information over "voluntarily" by creating laws under some pretense and threatening legal repercussions, or by just doing it illegally anyway using the usual scare tactics. The same can happen to you personally, and they can pretty much throw you in jail for an infinite amount of time until you produce the password in question anyway.

Anyway criminals are NOT brute forcing huge lists of passwords in the first place. They either take advantage of terrible security in the first place (Hey lets store all the passwords in an unencrypted text file which anyone can access if they know where to look!), software vulnerabilities (Hey your password is super safe, too bad there is that gaping security flaw that lets people bypass passwords altogether!), or social engineering (Hey sure I will give out your password, I'm an IT guy that gets paid 10$ an hour and I really don't give a shit anyway).

So while in an interesting sort of puzzle way this is neat, the actual protections it will afford you is probably very little.

https://xkcd.com/927/