Slashdot Mirror


User: Stephen+Samuel

Stephen+Samuel's activity in the archive.

Stories
0
Comments
2,758
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 2,758

  1. 'storing' passwords. on Root Password Readable in Clear Text with Ubuntu · · Score: 1
    Even when I write down a password, I'll do it (slightly) encrypted. That way if some gook gets hold of the paper and figures out what it means, they'll still probably spend half an hour trying to figure out what it really means.

    Hell, even I sometimes have to spend half an hour trying to figure out what I meant.

    The preferred method, however is to not write it down at all.

    Which reminds me: I don't trust installers to secure passwords. Quite often, I'll use a cheap password on installation, and then reset the password after the install is complete .... Just in case something like the instant STUPID bug occurs. Installers are often written by relatively junior programmers... the kind of people who are most likely to do stupid things like this.

    Silly story:
    Back in the '80s the original BSD 4.0 code for chfn (change full name) allowed you to set the GCOS field, but did absolutely NO input validation....

    I ran into it because I accidently put a ':' into my gcos field -- which messed things up until I created another mangled entry that included a newline (to get the original garbage out of the way. Then I realized that I could could do something like:

    chfn 'myname:/u/myname:/bin/bash
    myname2:<encryptedpwd >:0:0:my root login'
    Now I had a root login that I could use to clean up the mess I had made in the /etc/passwd file.

    I cleaned things up and then hunted down our sysadmin (I was a lowly student at UofA back then) and explained the problem. It didn't take him very long to get the patch out.

  2. Moderator note Re:Obligatory comment on Fossil Rises From its Grave · · Score: 2, Informative
    The "Jesus, you have to explain your joke in your title.... and the joke isn't even funny!" is quoted from an AC troll, which Bad D.N.A. was unfortunate enough to respond to (and quote).

    This is why the moderation guidelines (used to) suggest moderating at -1 -- so that you don't confuse a quoted response with a off-topic/troll original comment. If in doubt as to why something is posted, you can always click on the 'parent' link to make sure you know what is being responded to.

  3. Re:rootkits? on Microsoft Research Warn About VM-Based Rootkits · · Score: 1
    Public Key encryption. You write the configuration/benchmark info , and save it with a signature. You check it against a public key written onto the boot CD (multi-session). The only time that you should have the private key on your system (floppy or USB key) is when you're reconfirming your system (and booting from the CD).

    It's not perfect, but it should do a good job against most attacks.

  4. Re:I say we take off... on Microsoft Research Warn About VM-Based Rootkits · · Score: 3, Insightful
    If the rootkit is sophisticated enough to infect the BIOS, what keeps it from flashing the HDD firmware as well?

    Well, if you take a suspect disk, put it in a clean machine and then boot from the suspect disk then you're not just boned.... you're too stupid to be an investigator.

  5. (related) Strange phish email. on PIN Scandal 'Worst Hack Ever' · · Score: 1
    I got a fish with a wierd bit of code....
    identity over a secure connection at:</p>
    <a id=3D"SPOOF" =
    href=3D"http://citibusinessonline.da-us.citiban k.com.lawases.com"></a>

    <div>=20
    <table>
    <caption> <a href=3D"https://citibusinessonline.da-us.citibank. com/cbusol/signon.do?ao=3Df">=20
    </a><a =
    href=3D"https://citibusinessonline.da-us.citiba nk.com/cbusol/signon.do?ao=3Df">=20
    <label for=3D"SPOOF"> <u style=3D"cursor: pointer; color: blue"> =
    https://citibusinessonline.da-us.citibank.com/c busol/signon.do?ao=3Df</u>=20
    </label> </a> </caption>
    Does Someone recognize this as working on Outlook? It directs me to https://citibusinessonline.da-us.citibank.com/cbus ol/signon.do?ao=f on thunderbird.

    but the intended target seems to be citibusinessonline.da-us.citiban k.com.lawases.com

    The lawases.com page does some strange javascript -- perhaps it does a javascript keylogger??

  6. Re:Couple of things here... on Linus on GPL3 In Forbes · · Score: 1
    There are two ways to license under the GPL.

    One is: License under GPL V2.1 or any later verson.
    The other is: License under GPL V2.1. (period).

    In the former case you could relicense under GPL3 without asking anybody. In the latter case you would have to get hold of the original authors and get their permission first.

    Linus chose the latter case.

  7. Re:Couple of things here... on Linus on GPL3 In Forbes · · Score: 2, Informative

    Once you add your own code and upgrade the license to V3, I think that it's possible to effectively lock it into a V3 license. I could revert to the original v2.1 cidem code, but if I want to use your new code, I'd be pretty much stuck with V3.

  8. Re:Liars, Damned Liars and Statisticians on iTunes Sales Ban Does Increase CD Sales · · Score: 4, Insightful
    So one can reasonably conclude that iTunes, at least in an indirect way, is forcing labels to sell their music cheaper in order to secure more sales! I'd interpret it as: Cutting prices can increase sales.

    Also not mentioned here is that the Brown album was available for download ONLY for over three months before they released the physical album. '

    so what I see being 'proved' is that:

    • Disallowing CD sales for 3 months cuts into CD sales.
    • Cutting the prices for CDs increases CD sales.
    • exhausting your Radio play before releasing an album can cut into album sales.
    • Forcing fans to download music increases downloads.
    • Being available online for 3 months can increase downloads.
    and for number one......

    Bare statistics can be misleading.

    ((mumbles something about hanging by the toenails and being beaten by an organic carrot))

  9. Re:Beware Your EULA on Does Using GPL Software Violate Sarbanes-Oxley? · · Score: 2
    Not only would it violate the principle that once you have paid for a license it is yours to dispose of as you wish (doctrine of first sale),

    If you're saying that, I'd have to conclude that you've never actually read (and understood) your MS windows EULA.

    Once you buy an article you can do what you want with it. Licenses are arbitrary... That's why the EULA has the claim "you agree that you have licensed this software, not purchased it (or something to that effect).

    Under general copyright there is no need to obtain a license to run a piece of software. The doctrine of fair use would allow you to install and use it to your heart's content on any one machine.
    In theory a license is supposed to grant you something that you would not normally have.. MS licenses seem to do nothing other than take away rights that you would normally have. I think that that's part of the reason why EULA 'agreement' pages are designed to discourage you from actually reading them.

    From the current XP-Pro SP2 eula. (find it here)

    3. RESERVATION OF RIGHTS AND OWNERSHIP. Microsoft reserves all rights not expressly granted to you in this EULA. ..... The Software is licensed, not sold. (emphasis MS's)

    8.Upgrades. To use the software identified as an upgrade, you must first be licensed for the software identified by microsoft as eligible for the upgrade. After upgrading, you may no longer used the software that formed the basis for your upgrade eligibility. (emphasis mine)

    14 ..... The initial user of the Software may make a one-time permanent transfer of this EULA and Software to another end user, provided the initial user retains no copies of the Software. ..... The transfer may not be an indirect transfer, such as a consignment. ....

    It just kinda goes downhill from there..
  10. Re:My experience on Financial Responsibility == Terrorism? · · Score: 1

    If $6K was a large multiple of what they normally pay, then they've been paying interest on it for a long period of time. If they are paying off the entire amount, they may not be paying interest on whatever they've bought in the last month. Beyond that, I believe that interest is calculated daily but only compounded monthly. As for the 15%, that's just a generic guess as to the ballpark of what they're paying. Interest rates on cards can vary widely, and there was no mention of the exact rate that they're paying.

  11. Re:Intended Consequences of laws on Does Using GPL Software Violate Sarbanes-Oxley? · · Score: 1
    You offer some very valid advice -- if we were still living in 1910 or 1950 or maybe even 1970.

    The difference between then and now is that we now have laws in place that disallow the worst of those past abuses. Remove the laws and the abuses will almost certainly come back.

    I'm working on a mathematical proof of the need for anti-monopoly laws. Without activity limiting laws, it is easy for corporations to go completely overboard.

    'Company towns' are just fine for the priviledged few who the corporation considers critical to their survival.... for as long as that's true. However, once those people are deemed disposable, the services that the corporation provided can disappear as quick as it takes to write a memo.

    I talked to a forester on the central coast of British Columbia who told me of what happened to a 'company town' late '80s early '90s. (I didn't get an exact date, but I was told the story in 1995 and it was given as recent history).

    It was a company town in the general region of Bella Coola that was based on the logging industry. It had wonderful conveniences, and the company built, for example, a brand new gymnasium/theatre for the community to use. The next year, they decided to shut down logging in the area, and they ordered everybody out. The brand-new gymnasium was ordered abandoned. People were not allowed to remain there -- even if they wanted to -- because the town was private property of the corporation.

  12. Beware Your EULA on Does Using GPL Software Violate Sarbanes-Oxley? · · Score: 3, Interesting
    Man, if you're worried about the GPL, imagine what happens if you use Microsoft Software?

    Under the MS EULA, once you upgrade your software, you have no rights to use the older version(s). This means that if the 'upgrade' breaks your mission-critical software you are so toast.
    If you don't revert your software, then your mission-critical software wll remain broken until Microsoft deigns to fix the issue.
    If you do revert your software then you're in violation of the EULA and subject to having Microsoft demand that you delete the entire package at any time.

    With the GPL, you're only likely to run into problems if you want to distribute the software without distributing the full source. You can sometimes get away with not publishing the source to isolated parts of software written by you, but at that point you're running on the border and should talk to lawyers to make sure that you're not crossing over the line.

  13. Re:My experience on Financial Responsibility == Terrorism? · · Score: 2, Informative
    That's 1 week at 15%/year. do the math... Units is real nice, if you've got Linux/BSD:
    $ units 6000-15%/year /week
  14. Re:My experience on Financial Responsibility == Terrorism? · · Score: 4, Insightful
    The reason why these people noticed was that they saw that the cheque had cleared their account a few days ago, but the credit card company hadn't changed their balance .... So they started asking questions .. like: where's the $6K that you just took out of my account?

    This also has a nice bonus for the credit card company... if they hold off crediting the $6000 for a week, at 15%, that comes to about $17 ... or $75/month (if they can make the 'investigation' last that long).

  15. Re:They're right. on MS Thinks OOo is 10 Years Behind · · Score: 1
    And then the joy of watching them struggle to fix it if they change font size or font family entirely. Even more funny when they do it with tables.

    Guess why I notice this grotty formatting style? I quite often get semi-anonymously done documents and decide that I want to fix something (sometimes as simple as a typo or gramatical error) and find that the document has the sickest of formatting features.

    Half the time, I end up just fixing the formatting, and wondering who doesn't understand what they're doing.

  16. Re:They're right. on MS Thinks OOo is 10 Years Behind · · Score: 1
    I've lost count of the number of times that I've seen people do things like implement indented paragraphs with hard line breaks and spaces.

    There are a lot of people who can't use the 15 year old features of MS Office. Adding another decade or so of creeping featurism on top of that just makes life harder, if anything.

  17. Re:10 years behind? Sounds about right on MS Thinks OOo is 10 Years Behind · · Score: 3, Interesting
    Multi-lingual support is better, especially Chinese and such using Unicode fonts.

    Do you know how that compares to OOo's multilingual support?

  18. Re:Law suit bullshit... on Skype 5-way Calling Limit Cracked · · Score: 1
    In what way is that different from say a company that produces accessories for one specific car manufacturer?

    No one car manufacturer has a dominant share of the market, so it's relatively expensive to generally go for exclusionary deals -- unless you're dealing with a bit-player who's hungry for a reciprocal deal, in which case the deal doesn't warp the market by appreciably.

  19. Re: hd faster than network unless... on Linux Support for Hybrid Hard Drives? · · Score: 1
    Remember that our 3 1/2 inch drives are half height!!!

    Most people are no longer aware that a regular CD-ROM is half-height for a 5.25" disk bay. About the last thing that I've seen that took a full-height 5" slot was 8mm tape drives.

  20. Re:Law suit bullshit... on Skype 5-way Calling Limit Cracked · · Score: 5, Insightful
    Of course, I'm ignorant. But how come a law suit? Companies make marketing arrangements all the time.

    The rules change slightly when you've got a near-monopoly. This is part of what tripped up Microsoft in their anti-trust trials.

    The problem is that it's far easier to convince someone to exclude "the competition" from the market when the competition has a disproportionately small portion of the market.

    For the ease of math, let's say that the Skype market is 90% Intel, 10%AMD. If Intel had to pay Skype 10million to compensate Skype for the lost market in excluding AMD then AMD would have to pay 90million to get Skype to do the same thing. Add to that the fact that Intel has 10x as much income from their larger market share (presuming the same gross profit margin -- which is rarely accurate in a near-monopoly situation) and you have a 90-1 difference in impact on their profit margins.

    Or - - to put it another way, between gross profits and market share, Intel could afford to buy off 100 market slots for every one that AMD could afford to.
    If it came to open warfare like this, AMD would be reduced to a tiny portion of the market and customers would be effectively unable to even find business that deal with AMD. (Dell anyone?). Once you further reduced AMD's market share like this, Intel's ability to further marginalize them would increase until AMD was reduced to an insignificant market access independent of the relative quality of their products.

    It's basically a market-ratio squared relationship which can easily spiral into a near-absolute market ownership, denying customers any real choice in the market no matter how good the competition is. (MS/Linux, anybody?)

    It's actually a worse than ratio squared relationship because we haven't taken into account the probability that, if Intel has a 100-1 ratio of market-exclusionary agreements, they can now charge a higher profit margin without significantly affecting customers' willingness to buy AMD. That, however is harder to quantitize, so I'll only mention it, rather than including it in my math.

    About the only real way to avoid this problem is to create artificial rules designed to stop such market-killing agreements when the market gets too lopsided, to prevent market choice from getting totally destroyed.

  21. Re:sync on Linux Support for Hybrid Hard Drives? · · Score: 1

    That barely makes sense. You should be able to write to disk far faster than you read network data -- unless you're reading from a RAIDed mail server over a gigabit LAN.

  22. Skunk team? on No Backdoor in Vista · · Score: 2, Interesting
    "Besides, they wouldn't find anybody on this team willing to implement and test the back door."

    (emphasis mine)

  23. Re:sync on Linux Support for Hybrid Hard Drives? · · Score: 1
    If you do it properly, you shouldn't have that much of a performance hit. Linux also has subroutines for explicitly flushing data on a specifid File Descriptor to disk (for situations where the order is important, like databases).

    Between the horrific speed differences between RAM and disk and the importance (nay -- criticality) of permanent storage, disk caching is an especially touchy space to work the tradeoffs.

    If you don't cache at all, then you get horrific speed hits. If you cache too eagerly, then risk losing gobs of data if the device is disconnected, the OS horks or you suddenly lose power. Microsoft seems to be controlled by the marketing people, so I can easily see engineers being forced to make bad tradeoffs by marketing people responding to customer complaints.

  24. mask off the plug. on Replacing the Housing on Your Flash Drive? · · Score: 2, Informative

    If you're worried about getting epoxy over parts where it might get in the way of plugging in, then just mask off the plug part..
    Just mask off the plug itself with masking tape, then wrap that in putty. If you don't like the idea of getting putty on the end of the epoxy, then get a piece of stiff plastic and cut a hole the size of the plug, and slide that up the plug, then continue as above. When you're done, you can usually just peel the plastic off the epoxy. If in doubt, add a thin layer of petroleum jelly (Vaseline) to the plastic.

  25. sync on Linux Support for Hybrid Hard Drives? · · Score: 1
    ...then found out that they had all disappeared on reboot because I hadn't explicitly unmounted the disk. *grumble*

    The SYNC command forces the system to flush all buffers to disk. Once it returns, you know that all currently cached data has been at least scheduled to be written to disk. (current documentation claims that it doesn't return until the data has actually been written). Once data goes to the HD, it may still take a second or more for it to clear out of the internal drive cache.

    for older kernels, you can also run the 'update' progrem which will periodically flush the cache. (RH5.2 probabably was old enough to need this). On the most recent kernels, this capability is now supposed to be built in.