Slashdot Mirror


User: smartr

smartr's activity in the archive.

Stories
0
Comments
282
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 282

  1. Do this... Take the amount you pay in federal taxes each year... And double it... Then, here's the neat part, get $26k tax free... I don't know why all the kids would be getting this $26k, and that's a rather high figure. Turns out a lot of other programs are unnecessary when you do this. Cut those programs. You could probably balance it at a significantly lower tax increase. You could also eliminate the minimum wage. A large amount of money is lost to theft and waste. Chances are large swaths of our society are working completely pointless jobs that add nothing of value to society whatsoever. If you're completely financially secure, you're probably less likely to try and rob a bank or shoplift. Crime would go down. It's almost like the people doing the work would have to either be paid well or just be happy to be doing the work. Maybe jobs come with fringe perks, like all you can eat burgers...

  2. Given that if the FBI really wanted to, they could get in, I think the key here is that the TSA needs to get into all the iphones. There could be child porn there.

  3. Re:yes they should on FBI Should Try To Unlock iPhone Without Apple's Help, Lawmaker Says (csoonline.com) · · Score: 1

    I'm not sure it really makes the case go away, it just makes the FBI look really stupid if it works. Be it that he's actually involved in the congressional questioning, I'd say his point is mainly the FBI did not in fact try. I'll throw it out there that the Chinese hardware was probably fabricated at an Apple factory... There's not much legal about copying that hardware... Nor is he really claiming it's something he's the only one coming up with it. While there's literally no nuance in this source article, you'd still have to buy yourself an extra iPhone or two and then plan a trip to China, for the primary purpose of pissing off the FBI... and Apple... There's no heroics involved.

  4. Re:yes they should on FBI Should Try To Unlock iPhone Without Apple's Help, Lawmaker Says (csoonline.com) · · Score: 1
    Zdziarski, author of iPhone forensics, seems to suggest it's quite likely a viable technique: http://www.zdziarski.com/blog/...

    Directory Comey made another misleading statement – twice – to Congress yesterday; namely that the FBI has attempted every possibility of unlocking the device on their own, and is even willing to accept input from any experts. Quite the contrary, at least three possibilities have come to light that the FBI has not yet explored:

    • Imaging the NAND flash of the device and trying ten passcodes at a time; when the device wipes, re-flash the NAND with the original image and try again. This technique is done in kiosks in Chinese malls to upgrade your 16 GB iPhone to 128GB for about $60 US. $60 for ten tries, they could pay retail and still get this done for $60,000.
  5. Re:You should already assume this on iOS 9.3 Will Tell You If Your Employer Is Monitoring Your iPhone (mashable.com) · · Score: 1

    Yes, it bothers me if a company tracks these things. I think there's a certain degree of, if you leave what you're doing out in the open, you should be putting some effort forth to do some things privately. But to the extent of what should matter to a company should be that they can secure their company information and their hardware. I have both a company laptop and phone. Once upon a time I was actively using an iPod touch, a work smart phone, a personal smart phone, a work Mac Pro, a home laptop, a work windows desktop, a home windows desktop, a landline, a work landline, google voice, and a mac mini (and I'm not even counting my wife's devices or various server farms). You should try going through an airport with a load of these. Fuck that shit, they're not tracking me on most things (much less actively), and I'm not running a separate business on their hardware. I'm not going to steal their property. I'd be wondering what my coworkers were doing, tracking my personal movements, and I don't know what business I would have basically stalking my coworkers. In an emergency, it would actually be nice for my employer to track down my location. Phone companies log calls automatically (and give that information to your employer AND THE GOVERNMENT), and there's the "find my phone" when it gets lost. Never mind that conceptually, as a company, you don't really get to call things "ok for not business purposes too" without the potential for it to turn into some sort of Kafkaesque IRS nightmare. I have seen employers that basically want to GPS track their hourly employees though. That would be the time to form a union. I heard that a person lost their job for installing a pornhub app on their phone in the USA after Apple fucked up the data usage. I'd say the employer, Apple, and the phone company were being shitty. At the same time, there's also such a thing as https and privacy mode...

  6. Re:yes they should on FBI Should Try To Unlock iPhone Without Apple's Help, Lawmaker Says (csoonline.com) · · Score: 1
    The thing is, the hardware UID key is software filesystem key. If you can't see the UID, a brute force attack goes from something like ten thousand posibilities to a septillion possiblities. The software filesystem key is stored in effaceable memory. What makes that memory inaccessible beyond someone failing the normal routine and it getting erased? Here's what the iOS security guide says: https://www.apple.com/business...

    The metadata of all files in the file system is encrypted with a random key, which is created when iOS is first installed or when the device is wiped by a user. The file system key is stored in Effaceable Storage. Since it’s stored on the device, this key is not used to maintain the confidentiality of data; instead, it’s designed to be quickly erased on demand (by the user, with the “Erase all content and settings” option, or by a user or administrator issuing a remote wipe command from a mobile device management (MDM) server, Exchange ActiveSync, or iCloud). Erasing the key in this manner renders all files cryptographically inaccessible.

    So - if you copy that key - that one key that's, "not used to maintain the confidentiality of the data", then prevent the erasing system from working its magic.

  7. Re:yes they should on FBI Should Try To Unlock iPhone Without Apple's Help, Lawmaker Says (csoonline.com) · · Score: 1

    The key is derived from a) a chip on the motherboard, and b) your PIN. The chip is specifically designed so that it ain't gonna tell you it's bit unless the PIN is right. You could probably get the hardware bit of the key by destroying the relevant chip to read it, but if you fuck that up the key is gone forever, and you still don't have a PIN. And the whole shebang kills itself (including the hardware bit of the key that you actually need if you wever want to read the iPhone's data) if you enter the wrong PIN 10 times.

    The "Chip" you're talking about is the security enclave which is not on the iPhone 5C. The filesystem key is not stored in the security enclave. If you make a copy of the encrypted memory that stores the filesystem key bit for bit, then you've defeated the erasing system. It's also possible the FBI is terribly incompetent given they have multi million dollar forensic labs that can't figure out how to copy this memory.

  8. Re:can they get in to your phone with out your pin on iOS 9.3 Will Tell You If Your Employer Is Monitoring Your iPhone (mashable.com) · · Score: 1

    They can get into *their* toilet, which they are letting you use, without your any bolt-locks if they are doing it right. IOW - If your employer provides you with a bathroom break, it's not really yours.
    FTFY

  9. Re:You should already assume this on iOS 9.3 Will Tell You If Your Employer Is Monitoring Your iPhone (mashable.com) · · Score: 1

    Because paranoia, paranoia, paranoia? I mean shit, we are all capable of carrying 10 different devices for 50 different purposes, or you know - a single general purpose computer that maybe shouldn't be monitoring people off active work duty. Is the phone supposed to be part of some sort of ultra secure secret network? Why did it leave the ultra secure secret building? Does it actually make sense from a non corporate brown nosing perspective to actually monitor your employees whilst they take a shit? Secure the device, yes. Secure your own network, yes. But seriously, do employees need to bury their work devices under a rock while they have sex and have bowel movements? Does it really matter if, god forbid, on their own time, home, and network use a general purpose computer they don't own for the purpose of whatever?

  10. Re:yes they should on FBI Should Try To Unlock iPhone Without Apple's Help, Lawmaker Says (csoonline.com) · · Score: 1

    Just because something is encrypted, doesn't mean you can't copy it. What's your source on this unreadable uncopyable "NAND" memory? Even if the filesystem key is stored encrypted by the UID and pin, if you can make a single copy of that encrypted block (and then repeatedly copy from that) - the complexity becomes a matter of brute forcing the pin (not the stronger UID or filesystem key). So, what's the story on this?

  11. Re:yes they should on FBI Should Try To Unlock iPhone Without Apple's Help, Lawmaker Says (csoonline.com) · · Score: 1

    The attack makes sense. The filesystem key is not related to the UID, and the filesystem key is what is erased to prevent brute-forcing, not the encrypted file system on the SSD itself. If you get a copy of the eh, erasable memory (which may or may not be stored on the SSD), then you have the filesystem key. Be it that Apple is very mum about what actually talks to the devices, I don't know where that part of the memory is. Be it that the 5C doesn't even have a security enclave, I don't understand why you wouldn't be able to just find the key and plug in the algorithm. With the security enclave, the phones would be vulnerable to the same attack, but they'd be rate limited by the security enclave meaning a small alphanumeric code could make it impossibly long to get into - but the self destruct system is bypassable.

  12. Re:You'll be disappointed on Anonymous Says US Senators Were 'Incorrectly Outed' As KKK Members · · Score: 1

    It's almost like the schmucks who are on the the list probably don't give a damn, except the ones who don't belong on the list or who are misidentified as being the ones on the list. Behold, KKK members David Duke and James Smith. Sure, James Smith might be the most common name in the USA, but herp derp KKK herp herp USA USA USA USA.

  13. Re:Should work fine on Proposed MAC Sniffing Dongle Intended To Help Recover Stolen Electronics · · Score: 2

    L8NT's patent pending methodology strips the M.A.C. addresses from packet headers and compares them to the M.A.C. addresses of known stolen devices in its database.

    OK, so they want to become a patent troll.

    It's a cop doing the patenting. I have no doubt he's excited and proud of his "invention". Let's think about this... Not every mom and pop burglary shop has decent IT staff, and they can get caught with said software. In fact, not every mid-sized business has decent IT staff that can make software like this. Furthermore, chances are the cops also don't have IT staff to make stuff (or use existing stuff) and then easily share it with other publicly funded IT staffs. It's almost like there's something of value to be had from dedicated developers and IT services while a large part of the computer illiterate world has yet to catch on.

  14. I think in the case of Florida and the gulf coast, it might be better to say that a wetland is an equilibrium, and so is a coastline.

  15. Re:So what will this accomplish? on Uber Capping Prices During Snowmageddon 2015 · · Score: 1

    Just a thought experiment for you here involving gouging. Say there are 100 nuts available every month due to inherent tree production, and on any normal day of the year, the going market rate averages to $1. While production could increase, increasing production will take time and money where there will not be any sustained demand to make it efficient to do so. Suddenly, one day before a giant blizzard, all the squirrels go bat shit crazy and buy all of the monthly nuts in a single day. The bat shit crazy squirrels are not taking their $1 nuts and re-selling that at some higher price. In the immediate term, nothing is going to produce nuts out of thin air, not even higher prices. There are only 100 nuts. While raising the prices of the nuts to $500 a pop will make the nut vendors more money, it will not increase the supply of nuts. Will some poor lucky squirrel who got a $1 dollar nut sell his nut for $500? In the immediate short term, the value of said nut is worth just as much as anyone else is going to pay for it and it is not worth giving up. In effect, allowing price gouging in this scenario only encourages squirrels to buy more nuts and price gouge each other, but it serves no useful market purpose....

      Of course, these aren't nuts that can easily be imported to increase supply New York, these are Uber drivers. Price gouging only makes sense socially if it is viable and reasonable to increase supply to fill the demand. The fact of the matter is, after a certain price increase you're simply auctioning off scarce resources and rewarding hoarders.

  16. Re:This was to be expected? on Bitcoin Volatility Puts Miners Under Pressure · · Score: 1

    I too find it amazing that people find this surprising. Given the rapid upward trajectory the bitcoin has had, a downward correction is not the least bit surprising. It may have great traits as a currency, but stability is not one of the traits bitcoin has been able to demonstrate. I also don't understand why inherent volatility should necessarily preclude its use. People still play the stock market, and volatility does not necessarily destroy the market.

  17. Nope... A vulnerability in a library is not a vulnerability in the underlying programming language. Just because the JRE *is* an execution environment, does not mean that the execution environment being run by a malicious user is a vulnerability in the JRE. That's like saying, there's a vulnerability in C, because Flash is written in C and there's a Flash vulnerability. The point is there is a **critical** vulnerability in older versions of the Struts library, which is used to escalate privileges to the JRE. Once you have rights to the JRE, you can copy files and have the JRE execute system commands using the rights given to it by the OS which should not be a root user(honestly, if they wrote the payload in Java this step would not be needed, a server environment is entirely capable of performing DDoS attacks). Also, I'm calling BS on this exploiting a known Tomcat vulnerability. There are no known "critical" vulnerabilities in any version of Tomcat :
    http://tomcat.apache.org/secur...
    http://tomcat.apache.org/secur...
    http://tomcat.apache.org/secur... ...
    Basically, people need to patch Struts 2 because of this fucker:
    http://struts.apache.org/relea...
    which was fixed in July 2013:
    http://struts.apache.org/downl...

  18. Re:Sigh on News Aggregator Fark Adds Misogyny Ban · · Score: 1

    The belief that homosexuality is not a choice is one I generally concur with. What assumptions and definitions I make about the world are pretty arbitrary. Obviously, every individual has a choice about who they choose to fuck and marry. What defines the start of your life, your sexual identity, and your sexual preference are as arbitrary as those who think God is self evident. Not being shitty tribal jerks over queer ideology would be nice, but I don't really blame the tribe for being feeling vengeful for the way they're generally treated.

  19. Re:Why? It's not always necessary on Google Will Give a Search Edge To Websites That Use Encryption · · Score: 1

    hear hear! Sure, encryption is great and has its uses... But also comes at the cost of processing, configuration, maintenance, and low cost 3rd party providers. GoDaddy is about a to get a shitload of extra customers. When the products in the market are comprable, the well known low cost one is frequently the winner. Thanks Google.

  20. Re:don't drive with nobody in it? on FBI Concerned About Criminals Using Driverless Cars · · Score: 4, Funny

    Not needing a passenger happens to be one of the more awesome features of driverless cars... People can effectively have valet drop off for wherever they go. Cars can be shared because you're staying put at a given location for a period of a time. Cars can drive themselves to maintenance. Cars can make delivery runs. Sure, it's another attack vector, but so is putting salt in your eyes. The danger is imminent, don't put salt in your eyes. I think the more eminent threat is that automated cars are going to result in lots of sex happening on the road. I mean really, what do you think happens when you put people in a close quarters private 15 minute outing, with a virtual guarantee of no interruptions and no need for any person to be paying attention to what's going on outside of the car?

  21. Re:Why? on Google Engineer: We Need More Web Programming Languages · · Score: 1

    GWT is just a normal server-client web architecture with the bonus of a component architecture that makes everything like Swing, which is kind of to say you're avoiding Javascript and the DOM, when it's actually your primary presentation layer. Why not just use Ruby on Rails, Struts 2, or Django? In theory, local storage with ECMA might bridge the gap some. CouchDB theoretically supports this so called always online-offline architecture, where you sync everywhere eventually and could run chunks of the system offline (assuming you get everyone to install their own instance of CouchDB). Node.js at least keeps you in mostly one language set... Of course, then you're in a mess of figuring out to use things like Backbone.js and Angular.js...

  22. Re:Ah so that explains it on Cable Companies Use Astroturfing To Fight Net Neutrality · · Score: 1

    I'd recommend asking the libertarians:
    A. Do you think Comcast sucks, not just for terrible quality support, but for extorting money from the people you already paid them for the privilege of communicating with a la Netflix? If you desire access to the fastest connection available, Comcast is your provider in most of the country. Should not paying for the highest bandwidth access contractually cover your connecting with whoever you damn well please without Comcast extorting money from the endpoint you are communicating with?
    B. Comcast is given exclusive rights to use those lines through local governments. This is the case with pretty much all the cable companies. How do you feel about this collusion?
    C. The wires and airspace frequencies are given a free pass through private property. Why shouldn't private property owners use the wires on their land how they wish?
    D. Do you think Comcast sucks? Do you have any actual plans that have a chance in hell of working besides telling people to move across the country or swap to a slower connection?

  23. Re:basic economics on Seattle Approves $15 Per Hour Minimum Wage · · Score: 1

    I imagine the more successful businesses will hire quality employees who they can demand more productivity from. Less productive employees and the unemployed will have less work opportunities. Workers who keep their jobs will be better off but will face a higher level of competition. Prices will increase slightly. Profits might decrease slightly. The gradual phase in will smooth things over. It seems like a pretty clear win for the short term. Getting a job in the long term will be harder and might solidify an underclass that does not earn minimum wage.

  24. Re:Since when is everyone guaranteed a lifestyle? on Seattle Approves $15 Per Hour Minimum Wage · · Score: 1

    Saying that employers should be the guarantors of the welfare of their employees outside of work sounds a lot like slavery, especially if jobs are scarce due to a high minimum wage.

  25. Re:A Solution on Melbourne Uber Drivers Slapped With $1700 Fines; Service Shuts Down · · Score: 2

    The ride-shares are additionally insured through Uber. Using Uber also causes the rides to be tracked, and removes the handling of cash out of the scenario. Your arguments are some of the exact reasons why you should use Uber over a Taxi company...
    https://blog.uber.com/rideshar...