Slashdot Mirror


User: UnderCoverPenguin

UnderCoverPenguin's activity in the archive.

Stories
0
Comments
796
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 796

  1. Re:hooray, eggheads on Researchers Dare AI Experts To Crack New GOTCHA Password Scheme · · Score: 1

    It might actually be worse, since the scheme describes providing a list of descriptions to choose from, one of which is the one that the user originally provided when the inkblot was generated.

    It is worse. The bot can just "choose" randomly. If the list is new each time. the correct answer will be the one item that is always in the list. If the items are the same each time, it will eventually get the right answer.

    True, limiting the number of guesses at a given time will slow the bots down, but they can do a single to each account in a list long enough to provide enough delay between attempts with out having to idle between attempts.

  2. Get whoever did Kentucky's website on Healthcare.gov Official Resigns, Website Still a Disaster · · Score: 1

    I keep hearing how great Kentucky's ACA website is. Has anyone looked into getting whoever did that to find out what it would take to configure/adapt it to work for other states?

    Assuming that's possible, make a website for each state the fed gov is handling and make healthcare.gov a redirecter to the state specific sites.

  3. Re:And there's a whole series of comments at Ars.. on Ars: Cross-Platform Malware Communicates With Sound · · Score: 1

    I just tested my PC's speakers / microphone... The power output is rock steady up to 15kHz, then falls to 75% by 20kHz, 50% by 30kHz, and about 10% by 40kHz. Then it stays that way to fiftish kHz, which is as far as my loop went.

    How did you test it?

    The typical PC sound card as a DAC frequency of 44.1kHz, so the frequency of the carrier tone would have to be less than 22kHz - probably around 15kHz - to reliably transmit data.

  4. Re:And there's a whole series of comments at Ars.. on Ars: Cross-Platform Malware Communicates With Sound · · Score: 1

    I'm not up on my Audio Engineering, so excuse me if this question is recockulous, but since mic / speakers basically work on the same principles, is there any chance that its theoretically possible they are transmitting ultrasonic with the mic and receiving on the speakers!?

    No. The input and output circuit amplifiers are arranged to only allow signal flow in one direction.

    FYI, amplifiers can be arranged to allow 2 way signal flow (aka "full duplex") over a 2 wire connection. An example is a basic, landline telephone. You can demo this with 2 basic, landline phones, 2 phone jacks and a 9V battery. Connect the red wire from one jack to the red wire from the other, then both to + on the battery. Likewise, the green wires to - on the battery. Then with an assistant, each of you pick up one of the 2 handsets. You will be able to talk and hear each other over the 2 wire connection between the phones.

    Over simplified diagram: http://pastebin.com/hQN58jDd - Download and save with the extension ".svg" then open file with Firefox, Chrome or Opera to view it.

  5. Re:Dump SSL / Certificate-based Security on Silent Circle, Lavabit Unite For 'Dark Mail' Encrypted Email Project · · Score: 1

    Is it fair to say that another shortcoming of PGP/GPG is that it encrypts the message body only, leaving the envelope in the clear?

    That is actually a short coming of the network itself. In theory, every smart phone or tablet could run its own email server to receive incoming email, so elide the need for the envelope. Still, the network will know which device connected to which other device. Even wireless mesh networks have to exchange routing information between nodes. Even if manufacturers did not include logging source/destination addresses in their devices, it would only take a few "compromised" devices to gather and forward the meta data.

  6. Re:Did the NSA just kill SMTP? on Silent Circle, Lavabit Unite For 'Dark Mail' Encrypted Email Project · · Score: 4, Informative

    Many protocols used over Internet were not designed with encryption because it didn't seem that important at the time.

    Contrary to popular belief, "designing in security" does not mean every protocol has encryption built-in. It does mean that when designing an implementation of a protocol, security is properly factored in. And, in a system, that encryption is used in the appropriate places.

    Most protocols on the Internet are application level protocols. Some applications would benefit from application level encryption because this reduces (not eliminates) risk of exposing unencrypted data. For most applications it's more efficient to implement a common encryption service then have the applications use that. That also has the advantage of enabling including encrypting the (final) endpoint identification (and other application identification) by implementing the encryption between the Transport and Network layers. Applications with their own encryption would also benefit from this.

    Even with application level encryption, many (maybe most) of the existing protocols are useful. Example: A subset of SMTP could be used in delivering email. The email client application would establish a secure connection to the destination email server then send the actual message(s) using SMTP. Both the client-server connection and the messages would be encrypted. The server needs some meta data to deliver the messages to the mailboxes, but the meta data would otherwise be encrypted on-the-net. The messages would be decrypted by the email client to display to the user. (Even if you used direct IM, the Transport layer meta data would still exist, so you only get a little extra protection from direct IM - but IM is only possible when both parties are online.)

    There is also value in implementing encryption just below the Network layer as this will encrypt the routing information as well. Still end-to-end at either the Transport layer or in the application (or, both) is vitally important.

    (For those not familiar, the Network layer is responsible for moving data packets around the network, ultimately delivering data to the destination host. The Transport layer is responsible for end-to-end communications and represents the host. The host is the collection of applications running in a machine (physical or virtual) that use the Transport layer to communicate with applications running in other hosts. The "final" endpoint is what TCP, UDP and several other transport protocols call the "port" (example: port 80 for HTTP/HTTPS servers))

  7. Re:News flash on How Your Compiler Can Compromise Application Security · · Score: 1

    There's a fun case in ARM's compiler, where you write something like this:
     

    int x[5];
    int y; ...
    for (int i=0 ; i<10 ; i++)
        y += x[i];

    That looks a common error hidden by undefined behavior: The array size and loop bound are coded with "hard constants". The problem arises when the programmer changes some, but not all, of the constants, so there is a mismatch. Better to use symbolic constants. Then you only need to change the definition of the constant. Also, the symbol can be given a descriptive name.

  8. Re:Fix the C standard to not be so silly on How Your Compiler Can Compromise Application Security · · Score: 1

    * Fixation of two's complement as the integer format.
      * For signed integers, shifting left a 1 bit out of the most-significant bit gets shifted into the sign bit.

    In two's complement format, this already happens. Example (using int8_t for simplicity):

    (int8_t)64 << 1 == (int8_t)-128

    FWIW, everywhere I have worked, using shift operations on signed or non-integer values is not allowed. Furthermore, we don't allow shifts as shortcuts for arithmetic purposes - if you mean to divide by 64, then write x/64, not x>>6. Shifts are for aligning bits, not arithmetic.

    I think shifts (and bitwise) operations on signed or non-integer values should be Implementation Defined - and highly discouraged.

  9. Re:Ardour on Ask Slashdot: Best Cross-Platform (Linux-Only) Audio Software? · · Score: 1

    Ardour is not lacking, rather the issue is the rest of the stack is more trouble than it's worth. For a serious studio a Protools licence is not a big deal. And very few people build from scratch on a GNU platform - mostly because most people are starting out as teenagers with no interest or exposure to FOSS.

    Harrison Consoles's Mixbus is another commercial product that is supported on Linux. Couriously, AVLinux has a demo version included despite Harrison's claim to not provide demo versions. I guess their website is out of date. I have not tried it because I don't want to risk liking it (I cannot justify paying even Harrison's reasonable price - I've already spent too much on hardware).

    http://www.harrisonconsoles.com/mixbus/website/purchase.html

    http://www.bandshed.net/AVLinux.html

  10. AV Linux on Ask Slashdot: Best Cross-Platform (Linux-Only) Audio Software? · · Score: 4, Informative

    AV Linux (http://www.bandshed.net/AVLinux.html)

    Has Ardour, LMMS, JACK and many other multimedia tools configured to work together. Can run either as live DVD or install to your harddisk.

  11. Re:Hangings on US Executions Threaten Supply of Anaesthetic Used For Surgical Procedures · · Score: 1

    Having had to euthanise some of my pets, I can tell you that vets generally use an overdose of an anesthetic. Larger animals require more and take longer to die, but will die when given enough. The use of a poison is generally to stop the heart sooner than would otherwise happen. In that case, the subject then dies of oxygen deprivation - aka, suffocation.

  12. Re:Hangings on US Executions Threaten Supply of Anaesthetic Used For Surgical Procedures · · Score: 1

    An anesthesiologist points out that these procedures need to be foolproof enough for guards with nothing more than a high school education to do. If someone is dosed with anesthetic, pretty much any way of killing them is going to probably be painless, and meets at least some people's definition of humane. And the poison is presumably well tested and super effective.

    The TFA also states that the anesthetic is part of the problem. The implication being, ultimately, that if the US continues to use any anesthetic to put subjects to death, the supply of all of these advanced anesthetics could be cut off.

    Even in the face of that possibility, I don't see the US putting an end to the death sentence any time in the next 50 years or os. Therefore, an alternative is needed.

    As for simplicity, the most basic heart monitor (3 connections: one to each wrist and one to either ankle - could make the elctrodes part of the straps) is super easy to use and more than good enough to make sure the subject is dead. Then keep the nitrogen flowing and the room closed for another 5 or 10 min after "flat line".

    As for the subject ppossibly panicing, don't tell him when you open the nitorgen valve. Just let him keep talking. Maybe even ask him questions to keep him talking.

  13. Re:Hangings on US Executions Threaten Supply of Anaesthetic Used For Surgical Procedures · · Score: 1

    I think a more painless is to use high explosives around the target's head.

    Too messy. And a lot of preperation of the subject (though less painful than being jabbed with a needle).

    Just as messy, but much less preperation for the subject (just strap the subject in to the chair and strap head in to the headrest): Charge a large enough capacitor to a few million Volts, then discharge it through the subject's head. The water content of the subject's brain cells will vaporize within a few milliseconds.

  14. Re:Hangings on US Executions Threaten Supply of Anaesthetic Used For Surgical Procedures · · Score: 1

    Willing? Sure... Capable? Probably not.

    I think the only thing I would have trouble with would be lobster. They scream if you do it wrong.

    Years ago I read that some restaurants serve lobsters live. The lobsters die by vivasectionn as the patrons cut them apart and eat the pieces.

  15. Re:Hangings on US Executions Threaten Supply of Anaesthetic Used For Surgical Procedures · · Score: 0

    There is a totally painless way that requires no drugs nor needles.

    As I learned in rebreather training, the pain caused by holding your breath is from build up of CO2, not lack of oxygen. Therefore, it is vitality important to frequently check your oxygen supply. There is no pain. You just fall asleep. If you are lucky, someone will connect their spare oxygen cylendar to your rig. If not, you will never wake up again.

    So, new method of execution: Continuously flood the death chamber with nitrogen. the flow of nitrogen will purge the chamber of both CO2 and oxygen. In a matter of minutes, the subject will fall asleep, then die.

    No drugs. No needles. No poisons, No pain.

  16. Re:vi on Ask Slashdot: Do You Use Markdown and Pandoc? · · Score: 2

    vi with Doxygen, since most of what I write is code. Also for other documents (yes, Doxygen is designed to extract markup from special comments, but it doesn't care if the input file is one block comment. Just start the file with /** and end with */). Makes sense to use the same tool.

    FYI, Doxygen also understands some HTML and recently added a subset of Markdown. I use a few HTML and Markdown elements, usually for lists and tables.

    For some documents, I use pure HTML, such as my resume. This gives me more control of the formatting. Also, MS Word understands HTML, so to provide a ".doc" file, I just make a copy with the .doc extension.

    I have tried other tools, like LateX and Lyx, but Doxygen and HTML cover %99.9 of my needs. (Wold be nice if Doxygen supported reStructuredText and MediaWiki markups.)

    (FWIW, I prefer MediaWiki markup over Markdown. My biggest complaint with Markdown as compared to MediaWiki is the link syntax and link handling. I think MediaWiki links are much better than Markdown links.)

  17. Re:I can get on-demand access to Game of Thrones? on Are Cable Subscribers Subsidizing Internet-Only TV Viewers? · · Score: 1

    I would rather watch Game of Drones

  18. Re:Cable Customer === Internet Customer on Are Cable Subscribers Subsidizing Internet-Only TV Viewers? · · Score: 3, Interesting

    My ISP is the cable company.

    At first, we just signed up for internet. The initial rate was $30/month. After a year, the cable company double it to $60. After another year, they sent notice that it would go up to $90. We called them to downgrade to the next lower tier. The customer service rep said if we bundled TV service, we'd only pay $80 and stay at the same internet service tier. After 2 years, that went up to $100 and has stayed there since. We have asked about dropping TV, but they told us they'd then have put us on a business account, which would be $120 per month - and, because of our location, the service would still be residential because our area is only wired for residential service.

    I can only guess that they really want to keep their TV subscriber numbers up.

    On the other hand, using the TV on demand feature does help us avoid hitting the monthly internet usage cap.

  19. HDCP doesn't rely on cable behavior (aside from good-enough-for-signal-integrity performance) between sources and sinks to enforce DRM. So, for a mere physical pinout adapter, there should be nothing that a 'malicious' cable could do (unless that 'cable' were a full-fledged HDMI sink baked into a line lump, which would be physically possible but wouldn't really be a 'cable' anymore), nor would there be anything (save blocking the audio entirely) that a 'trusted' cable could do to control a malicious HDMI sink.

    Possible explanation:
    The AMD graphics card does not provide an HDMI output - possibly to save on licensing costs. So, to get HDMI from the AMD card, you need an adaptor. An "AMD Certified" adaptor has licensing fee baked into the price. Other third party adaptors may (or may not) include the licensing fee, but AMD does not get "credit", but *IAA holds AMD liable, so AMD requires "AMD Certified" adaptors to have a secret chip built in which their drivers can verify.

  20. Re:This is New? on Space Camp: Not Just For Kids Any More · · Score: 2

    No, it's not new.

    When I was in highschool, 20 yeaars ago, I went to both Space Acadamy and Space Acadamy II. During the week I was there for SA-II, there were 2 groups of adults, one in SA, the other in SA-II. Their programs were completely seperate from ours, but we did get to talk with some of them. The adult versions of the programs were a lot more "hands on" then the highschool versions. We did a lot of science projects while the adults more than twice as many simulations. And we "kids" were awarded "credits", in "general science", from the local university. But, I would have happily traded those credits for the extra sim time.

  21. Re:Sure, to lower paying jobs on The Luddites Are Almost Always Wrong: Why Tech Doesn't Kill Jobs · · Score: 2

    Or we could just accept that, as necessary work gets automated, most of humanity is going to be on welfare

    I think that will take a very long time. The work ethic is deeply ingrained in our culture. Contrary to the claims of many prominant pundits, the vast majority of people receiving any kind of welfare would very much rather have real jobs than stay on welfare.

    In the meantime, I expect we will see a vast increase in the number of people living in poverty.

  22. Re:Home server not the fix-all on ArkOS: Building the Anti-Cloud (on a Raspberry Pi) · · Score: 1

    Maybe.

    Renting a server (virtual or physical), "your" server is still the property of the service provider. This project is about enabling people to avoid the problems associated with that.

    Also, I don't think co-location will be much help, either. While you certainly own the server, it's still in the custody of a third party.

  23. Re:So why is it used in Windows? on Bill Gates Acknowledges Ctrl+Alt+Del Was a Mistake · · Score: 1

    Bill Gates is a fucking idiot with such a severe case of "not invented here" syndrome he created an alternate key combo rather than use the one that's LABELED on the FUCKING KEYBOARD?!

    There was no "SysRq" key on the original PC keyboard: http://en.wikipedia.org/wiki/IBM_Personal_Computer#Keyboard (click on the picture for a larger view) - It was added for the PC/AT: http://en.wikipedia.org/wiki/IBM_PC_keyboard

  24. Re:Revised Summary on The Man Who Created the Pencil Eraser and How Patents Have Changed · · Score: 1

    I read an article (can't remember where), saying that companies are actually FORBIDING their employees from checking the patent database, just in case they find out that another patent might perhaps cover something they are working on. This way, if a lawsuit occurs, they can claim ignorance of existing patents.

    Wouldn't this then fall under the crime of "willful ignorance"?

  25. Re:Your primary duty.... on Why One Woman Says Sending Your Kid To Private School Is Evil · · Score: 1

    As best I can tell, it wasn't a reallocation of resources, but simply a change in policy. When i went to the school, at the end of K, I was tested and passed all the requirements for completion of 2nd grade, so was placed in 3rd for the next school year. My K teacher said I could skipped K and 1st and gone directly to 2nd, but the district wanted all children to attend K.

    With my daughter, there was no placement test. In fact, the K teacher outright recommended we get her into a private school that could work with her rather then against her.

    About the only motivation I can see for the school to stop placing students into higher grades as they perform would be a misguided attempt to push up the test score averages. But, as i understand, the averages are only part of what "no child left behind" looks at, and that the scores of the lowest performers are just as important - if not more.