Slashdot Mirror


User: VortexCortex

VortexCortex's activity in the archive.

Stories
0
Comments
5,203
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 5,203

  1. Re:Themes... on Ask Slashdot: How To Start With Linux In the Workplace? · · Score: 3, Interesting

    Looks like and acts like are totally different things. While looking like windows might get you past the initial "it's not what I know" reaction, it's still going to take training to take windows folks into the brave new world of Linux.

    As contrasted with training users to embrace the utter cluster fsck of nausea inducing purple and green bruised UI vomit that is Windows 8?

    I install Debian and Gnome (2 or 3) or KDE for elderly folks at the community center. Guess what? They have less of a problem going from XP to Linux than from XP to Vista, 7 or 8. Gnome's "dead-zone" which prevents shaky hands from accidentally copying when they want to double click is a favorite feature among the elderly. In fact, since Windows8's release I have tripled the number Linux installs and instead of just extending the life of old hardware both young and old folks just want a release from the non-communicative anti-discoverable W8 interface bullshit. I have been met with driver issues downgrading from Win 8 to Win 7 on many occasions, whereas a Linux live CD works out of the box far more reliably. On systems where the install wouldn't work for some reason, e.g. MS surface or surface pro hardware, most folks I meet would rather return it to the store or pawn it than continue using Windows, AOL Kids Edition.

    If barely computer literate fuddie-duddies can cope, then the "Linux retraining cost" is just FUD. Anyone who really can't adapt should be fired for incompetence, heaven forbid a necessary website be changed while they're employed with you.

  2. Natural Born Cancer on Theo De Raadt's Small Rant On OpenSSL · · Score: 5, Insightful

    Well, what you are pointing out is that a CA is a single point of failure -- Something actual security conscious engineers avoid like the plague. What you may not realize is that collectively the entire CA system is compromised by ANY ONE of those single points of failure because any CA can create a cert for ANY domain without the domain owner's permission. See also: The Diginotar Debacle.

    The thing is, nobody actually checks the the cert chain, AND there's really no way to do so. How do I know if my email provider switched from Verisign to DigiCert? I don't, and there's no way to find out that's not susceptible to the same MITM attack.

    So, let's take a step back for a second. Symmetric stream ciphers need a key. If you have a password as the key then you need to transmit that key back and forth without anyone knowing what it is. You have to transmit the secret, and that's where Public Key Crypto comes in, however it doesn't authenticate the identity of the endpoints, that's what the CA system is supposed to do. Don't you see? All this CA PKI system is just moving the problem of sharing a secret from being the password, to being which cert the endpoint is using -- That becomes the essential "secret" you need to know, and it's far less entropy than a passphrase!

    At this time I would like to point out that if we ONLY used public key crypto between an client and server to establish a shared secret upon account creation, then we could use a minor tweak to the existing HTTP Auth Hashed Message Authentication Code (HMAC) proof of knowledge protocol (whereby one endpoint provides a nonce, then the nonce is HMAC'd with the passphrase and the unique-per-session resultant hash provides proof that the endpoints know the same secret without revealing it) to secure all the connections quite simply: Server and client exchange Nonces & available protocols for negotiation, the nonces are concatenated and HMAC'd with the shared secret stored at both ends, then fed to your key-stretching / key expansion system AND THAT KEYS THE SYMMETRIC STREAM CIPHER SIMULTANEOUSLY AT BOTH ENDS so the connection proceeds immediately with the efficient symmetric encryption without any PKI CA system required.

    PKI doesn't really authenticate the endpoint, it just obfuscates the fact that it doesn't by going through the motions and pretending to do so. It's a security theater. SSL/TLS and PKI are essentially the Emperor's New Secure Clothes. At least with the shared secret model I mention above, there's just that one-time small window of PK crypto for secret exchange at worst (failing to intercept account creation means no MITM) and at best you would actually have the CHANCE to go exchange your secret key out of band -- Visit your bank in person and exchange the passphrase, etc. then NO MITM could intercept the data. HTTP Auth asks for the password in a native browser dialog BEFORE showing you any page to login (and it could remember the PW in a list, or even generate them via hashing the domain name with a master PW and some salt so you could have one password for the entire Internet). That's how ALL security should work, it ALL relies on a shared secret, so you want the MOST entropic keyspace not the least entropic selection (which CA did they use). If you're typing a password into a form field on a web page, it's ALREADY game over.

    Do this: Check the root certs in your browser. For Firefox > Preferences > Advanced > Certificates > View. See that CNNIC one? What about the Hong Kong Post? Those are Known bad actors that your country is probably at cyber war with, and THEY ARE TRUSTED ROOTS IN YOUR FUCKING BROWSER?! Not to mention all the other Russian ones or Turkish, etc. ones that are on the USA's official "enemy" list. Now, ANY of those can pretend to be whatever domain's CA they want, and if your traffic bounces through their neck of the woods they can MITM you and you'll be n

  3. Re:Discrimination of girls is bad and unethical on Google: Teach Girls Coding, Get $2,500; Teach Boys, Get $0 · · Score: 4, Insightful

    Well, the problem is seeing sick people in the hospital and thinking the doctors are making people sick. Correlation is not causation. Girls have equal opportunity and are making the choice not to be in CS and IT, that doesn't mean there's sexism or any reason to try to fix it. I mean, we don't have a shortage of STEM workers.

    Hell, even the girls that DO like to code are looking at Silicon Valley, where you're considered dead at the family raising age of 40, and making far better decisions about the future than the silly guys who will do what they like to do whether it's very profitable or smart in the long term sense -- Just look at the Mathematicians and Scientists who scrap and fight for funding, they're not doing it for the money... You can code for a hobby and make games or something, but have a real job elsewhere that's got more stability than churn.

    So what's the deal? If they know men and women are different, and that cross-culturally more egalitarian societies have even larger sex differences (probably because people are more free to do what they like doing), then they know no amount of teaching girls to code is going to fix the "gender gap" in the shitty STEM fields. So what's up with all the claims of anti-women discrimination when there isn't any evidence of that at all in the west? Ah, well they can leverage false guilt and shame and say, "We tried as hard as we can! We have a shortage of female workers in STEM! Title IX! Let us have more (lower paid) H1B employees and to correct the SEXIST M:F ratio!" You don't want to be called a SEXIST even if we have absolutely zero evidence of that, do you?! Ugh.

    Yeah, that's exactly what's going on. To be perfectly clear: We can accept that our gender differences will produce trends in the workplace without limiting individuals to only following the trends, and without or shaming them if they do so. However, all this inequality nonsense is rubbish. Equal Opportunity won't produce equal ratios of M:F because males and females are different! Look, it's not sexist that there are so few male romance novelists, right? Guys just don't want to do that job nearly as much as women do. Where's the research that shows the percentage of girls vs guys that actually enjoy STEM work (not just those that think they'll enjoy it as a prestigious high status position, then bail, like 80% of female participants from my gamedev group, when they realize how much time and social life they'll be sacrificing for thankless work mostly no one will appreciate)? I mean, you'd think that before shouting "SEXISM" they'd at least want to know for sure that it's not just women opting to take a different career path (like therapy, psychiatry, teaching or other female dominated fields), Right?!

    Wrong. Where's the outrage that there aren't enough male teachers, therapists, romance novelists, or more female coal miners, brick layers, waste management technicians, etc? Isn't that "sexist"? These Social Justice Warrior campaigns are just self selecting data and refusing to test the null hypothesis so they can leverage false victimhood to suit their political and economic agendas just like they've been doing so for at least the past three decades. You can expect as much from these fucking sexist and racist bigots, always. Not satisfied with making College into a social justice indoctrination camp they're bringing the totalitarian Orwellian bullshit to the lower grade levels; The better to brain wash your kids with, my dear.

    Next thing you know they'll want

  4. Back to the 1980s! on Intel and SGI Test Full-Immersion Cooling For Servers · · Score: 1

    Transformer oil - move out!

    Man, these greasy energon cubes are more than meets the eye, Optimus.

    I thought you had a taste for crunchy fried things, Bumblebee?

    When in Rome, do as the Romulans!

    Shut Up Starscream!

  5. Re:if i was in charge of an island nation on Cuba: US Using New Weapon Against Us -- Spam · · Score: 1

    Waiting weeks or years to get the next episode of shows airing right now without a .torrent? A few well crafted spoiler tweets gets through and you'd be gutted and roasting like a pig.

  6. Re:They might be right. on Cuba: US Using New Weapon Against Us -- Spam · · Score: 1

    Not sure how fat of a pipe you need to send roughly 17 text messages a second. But 300k text messages over 5 hours isn't really that much, unless they are going to a small amount of numbers. Must be running some old systems in Cuba.

    It's not the size of the pipe, it's the severity of the clog's filth. You grossly underestimate the content of these messages. TFA says some contained political rhetoric written by the CIA. I have quite a few routers that will barf core at the mere smell of partisan politics in the filters, and Cuba is getting weapon's grade bullshit!

  7. Re:The centre of the visible universe on Scientists/Actress Say They Were 'Tricked' Into Geocentric Universe Movie · · Score: 1

    it just complicates the orbital mechanics equations when you want to fly a space ship to Mars somewhat, that's all.

    Yeah, but it makes the equations to get from here to things besides mars essentially impossible to compute given the hardware available to run the course correction software. Take a look at Rosetta, the ESA's mission to catch a comet by its tail this year. Those are some crazy gravity assists.

  8. Re:it's all over on Heartbleed OpenSSL Vulnerability: A Technical Remediation · · Score: 2

    Back in my day this wouldn't have been an issue since we ran a host of different custom interfaces and clients. We had to organize our own cross country backhaul via overlapping local calling networks, and orchestrated email routing networks using outdials. Probably only hackers used clients with encrypted links for their BBSs.

    I don't know what you're talking about with that fed-speak. I never heard of any crazy lossy crap like duct-taping payphones together neither, but there may have been a few railroad tracks used as a transmission lines, or party-numbers as hubs to spook the ghost-busters at their own game, but those were just urban legends, of course.

  9. Re:what? on Heartbleed OpenSSL Vulnerability: A Technical Remediation · · Score: 5, Informative

    Was this badly translated from another language, or have I been out of system administration too long?

    Allow me to translate from buzz-ard to sysopian:

    SSL-Ping Data Exfiltration Exploit: Detection and mitigation even a flaming lamer that can't patch OpenSSL can use

    "Since this 0-day vuln was published skiddies have been exploiting it to leak data available to OpenSSL 64KB at a time via running one of the pre-written exploit proof-of-concept sources (as skiddies are wont to do) against a bunch of affected Internet facing services. This SNAFU is particularly FUBAR since all the distros that noobs use are building an ancient OpenSSL ver so they can't even push out a simple patch, obviously. We fingered the exploit in use and have a signature so your punk-buster scripts can detect the crackers and ATH0 before your cipher keys get the five-finger discount."

  10. Re:Free to play, otherwise known as pay to win.... on Do Free-To-Play Games Get a Fair Shake? · · Score: 2

    Well, I don't mean to insult your 7 years of experience repeating what you likely already know: It is the pacing cycle of build up and release found in everything from day/night, neurons, fire/reload, rising action/climax, browsing/buying, waiting/playing, suspense/resolution, ect. that is primarily the cause of the profit margins. By exploiting essential cognitive rhythms of rest and effort, risk and reward, etc. one can skillfully extract payment from the weak minded who are susceptible to the level of thought control available to our most immersive experience crafting medium of games.

    As a cyberneticist and student of neurological and behavioral sciences, I am vehemently opposed to the micro-transaction "Zynergy" system. Instead I ask for a fair price up front, and lower the price over time to hit certain impulse buy points among target demographics, or charge a monthly fee for services rendered. I use the pacing cycle to create games that flow better and are "addictive" fun, but I don't believe in building game mechanics around a sales model, that's just evil and limiting to the game developers as well.

    If I put the player Skinner's Box, I want their task to be enjoyable and their outcome to be more fun, not less money. I accept that I'll make less money myself by eschewing such sales practices; However to me making games is primarily an artistic expression, not primarily a business venture. Just look at how crappy paintings, sculptures, films, music, etc. are when they are designed primarily around making money, vs for artistic means. I refuse to cheapen myself and do that to games.

    The Arcade model was killed by the Consoles who did away with "pay to win". Likewise the micro-transaction model is not sustainable, as you will see when the payment processors start going offline and game lovers revolt against inability to enjoy the games born with such death sentences. Art should not be born with a needless death sentence, and society will not bear the elimination of segments of their game culture for much longer. The rejection has already began in force and will only get stronger, otherwise TFA wouldn't even have been written...

    Just because we can do something doesn't mean it's the right thing to do. This goes doubly any time money is involved.

  11. Re:SPF.. on Yahoo DMARC Implementation Breaks Most Mailing Lists · · Score: 2

    Really legit mailing lists should be rewriting the sender headers to reflect that the mail has been redelivered by the mailing list, the only difficulty this would cause is when users try to reply directly to messages rather than forwarding their replies to the list itself.

    Or the fucking email providers could not be dipshits and white-list the stuff you actually subscribed to when you validate your damn email address. This can be done with existing email solutions by offering an option:

    "This is the first message from this sender, allow further unsolicited messages [_] Yes [o] No?"

    The whole sender-provider and DMARC BS is fucking irrelevant since we've had white lists and PGP for essentially ever.

  12. Re:Money and marijuana don't mix on MtGox's "Transaction Malleability" Claim Dismissed By Researchers · · Score: 1

    A bank run by drug dealers and drug addicts won't keep your money safe, period.

    I know bankers are black, but are the drug lords green or white islandwalkers? Couldn't this disaster just be a big misunderstanding, like manna burn?

  13. Re:Good for Offroading... Offroading = mud on Land Rover Demos "Transparent Hood" · · Score: 1

    The thing I don't get with these camera displays is the fact that they don't seem to have wipers on the camera, with cleaning solution.
    Snow/Salt/Mud/Dirt really collect and make visibility bad. If you are offroading then one puddle and your feature is useless.

    ... uh, we could just install wiperless glass AKA ultrasonic wipers.

  14. Re:Hydrocarbons besides olefins? on Navy Creates Fuel From Seawater · · Score: 2

    It's too bad there aren't any bigger fish in the sea.

  15. Re:what's next? Zombie Rocks? on Zombie Plants Help To Spread Bacterial Pathogen · · Score: 1

    oh, yeah. pet rocks. sorry.

    Lichened unto Magic Rocks which help me break out and escape from Zombie Windows, fend off Zombie Mountain Lions and Snow Leopards, or even blind a spying Eye OS.

    Rocking Penguins can even kill Zombie Androids or break the locks on their boots.

    Rocks and Penguins rule. Don't have to worry about Zombie Penguins, their natural predators are Big Surly Daemons.

  16. Wow that's pretty cool, what's the killer app? on A 2560x1440 VR Headset That's Mobile · · Score: 1

    Wow, that's neat, can I buy it and add to my existing collection of VR and AR gear I've been using since Quake and Descent came out about two decades ago?

    I mean, I have mobile ready VR already, it's pretty cool, and doesn't have to look like I've strapped a toaster to my face... That high resolution is nifty, but how is it on battery life? That's the main thing for me, FoV isn't really that big of a deal since most receptors are concentrated in the center of your visual field anyway. Also, in my albeit limited studies, it's not lag-time but difference between visual and inner-ear inputs that primarily induces motion sickness, so any

    I really do hope VR succeeds in the general public this time around. There really isn't much in the way of good 3DUI experiences, so I've been doing some 3D experiments in input / output. I love having a full 360 degree desktop full of text terminals, documentation, issue trackers, tool-bars, palettes, actor models, and widgets off to the side and out of the way of the workspace, etc. Unfortunately, I have discovered that with combinations of two or more [accelerometer | compass | head tracking | eye tracking] I can achieve a different yet cheaper, less strain inducing, nearly as immersive, and somewhat similar feature set to what VR provides, but using any standard 2D screen -- they become 3D viewports into a virtual landscape. Lean in and tilt the head slightly to view surrounding workspaces, combinations of vocal, keyboard, mouse, and eye blink / motion for intuitive (yet easily controllable) focus acceleration and action input, etc. Even my grandma was surprised and grinning saying, "Oh wow, I can actually use this. It's like an actual window. Why isn't this on my TV right now?" So, I think AI + cameras embedded in our devices will be strong competition for the VR market.

    IMO, it is Augmented Reality (AR) that's really exciting. However, just like VR, there isn't much in the way of good UI design, and the wearable AR tech is still as expensive and clunky as the UI research itself remains... I have experimented with some brain-blowing concepts when combining my active display UI designs with wearable AR UI, but it makes some of my friends and family instantly puke -- unlike the active display itself, which doesn't induce nausea because it mimics something we're all familiar with, and aligns itself with our perception expectations by augmenting reality instead of enforcing a virtual reality. In other words, AR is not just for goggles anymore, and it's already better than VR in terms of IO ROI and monetary ROI, IMO, but YMMV w/ VR vs AR.

    TL;DR: VR is still cool but gimmicky hype that's soon to be obsolete before it even gets off the ground, unfortunately.

  17. Re:JUST USE POSTGRES on Ask Slashdot: Which NoSQL Database For New Project? · · Score: 1

    The great thing about MongoDB is you can install two or three servers in different datacenters, and have redundancy out of the box. It's really simple. And you can scale horizontally if you need to without any downtime.

    I've never had to use 3rd party solutions to implement horizontal scaling, replication, pooling, clustering, etc. with Postgresql. I have often had to demand changes of 3rd party vendor-lockin-ware, or add a kludge myself to fit a business's needs. RTFM application used to be far more common, but seems to have fallen out of fashion of late as more programmers and DBAs are increasingly discovered not to be hackers. Did you know Postgresql supports NoSQL features via HStore and JSON?

    Much experience has shown that it's better to look well before leaping rather than hop on the buzz-wagon then try adding wings on the fly. The problem with one-size-fits-all methodology is that when one designs a system with everyone in mind, one has actually designed it for no one at all. What happens when that "simple" redundancy solution meets a more complex problem space is that you're left with folks who didn't understand the issue in the first place trying to fix the problems they've caused.

  18. Re:JUST USE POSTGRES on Ask Slashdot: Which NoSQL Database For New Project? · · Score: 1

    Seriously - JUST USE POSTGRES - there is virtually nothing that it can't do.

    Indeed. With its native JSON type and HStore Key/Value store it has NoSQL features. Given Postgresql's ability to cluster, pool, and replicate it also scales quite well. IMO, it doesn't make sense to abandon all relational DB features in a NoSQL only solution (especially right off the bat) when you can have both. Postresql may just be the droids you are looking for.

  19. Re:NoSQL? on Ask Slashdot: Which NoSQL Database For New Project? · · Score: 3, Funny

    Shards! It has shards!

    Heal The Dark Crystal, Gelfling!

    Only then can the two be made one!

  20. Re:Edward is a bit naive on Snowden: NSA Spied On Human Rights Workers · · Score: 0

    We were doing this kind of thing back during Reagan.

    Actually, long before Reagan.

    We're serfs, not citizens.

    Couldn't have said it better myself.

  21. Re:Hang Him High on Snowden: NSA Spied On Human Rights Workers · · Score: 5, Insightful

    Does that dickhead talk as if he is forgiven for being a spy himself and the worst kind of spy at that? The kind that turns in his comrades and runs like hell to America's enemies for asylum..

    You mean the "enemies" that are our greatest allies in space? Look, the Nations are not the People anymore, haven't been for a long time. All that USA vs Russia shit is just rhetoric for manufacturing consent to wind up the very expensive military industrial complexes yet again. Those things don't help anyone. Talk to people from all around the world and you'll figure out that no one really wants to kill each other, we all just want to be safe and live our lives. The corporations that own the countries that use the laws of governments and religions against us are not the people of the world. All the nations are against the everyman. Snowden is an ally to the people of the world. Save all that statist "traitor" talk for the gulag.

  22. Re:Obese on A Conversation with Ubuntu's Jono Bacon (Video) · · Score: 1

    Damn, I thought you were joking but his moobs put most women to shame.

    It is times like these I am reminded of the Orangutan.

    The lean younger and over active orangutan males fail to impress most females. Instead they seek out the longer survived, more experienced, and gentler male with his hair covered bigness and prominent cheek pads.

    If they could speak their ladies would say, "I want a real man, not a scrawny thin-headed sucker who's tits and tool-shed haven't come in yet and doesn't even reek."

    It's as if nature finds perverse pleasure in mocking us by keeping examples of happiness around in branches of life's tree to remind us of the price we paid for our souls.

  23. Re:We don't do flash on A Conversation with Ubuntu's Jono Bacon (Video) · · Score: 0

    Any chance slashdot can support the use of non proprietary formats for video?

    It's Ubuntu, what do you expect? That's Swahili for switch/bait.

  24. Re:Damn you, Amazon and your bluetooth! on Apple, Google, and Amazon's Quest For One Remote Control Is Futile · · Score: 1

    I would not really prefer IR.

    I would prefer it be IR. I can already use my LG smartphone to control every IR capable AV device in my home, including projector screens and lighting setups. It is my one remote already. Works well with XBMC or Linux Media Center Edition.

    While everyone else scrambles to figure out who will dominate this space, me and my home cloud will continue streaming all my media to all my devices and controlling it all with an array of USB, Ethernet, RS-232 serial, and IR input AND output (the latter via Linux Infrared Remote Control)

    Remotes are a solved problem: My phone is the only remote I need damnit, I can even bounce the signal to the other side of the house via IR -> Ethernet -> IR with LIRC. Bonus: If I lose it, I can geolocate it then give it a ring and listen for the tone. Set top-boxes are solved too: A Linux media center PC. Why? Because a TV with built in computer is too expensive to upgrade as fast as I want for games, Steam is on Linux, all my media, Hulu, Netflix, and my cablecard is too. Why not a proprietary OS? I can't hack new things into a proprietary OS like I can with Linux or BSD, like the aforementioned Ethernet assisted whole home IR signal routing technology. See: XP EoL, that's why.

    If someone comes along and packages this shit all up nice and simple like -- Oh, guess what? Someone already did. My cousin does that for a living. He puts in very expensive whole home AV outfits. They use Ethernet as a backbone, and you can control anything from your tablet, phone, or these wanna-be phone/tablet looking touch enabled devices. Look up Crestron. I can do what they do for free with Linux. This Apple/Google/Amazon crap is playing at some mickey-mouse tier featureshit comparatively.

  25. Re:It's not that complicated on Meet the Diehards Who Refuse To Move On From Windows XP · · Score: 1

    Mixing development with browsing...
    But, that's how all viruses spread!