Slashdot Mirror


User: swordgeek

swordgeek's activity in the archive.

Stories
0
Comments
3,146
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 3,146

  1. Re:Perfect for stolen credit cards on Get Your iPod Fix From a Vending Machine · · Score: 1

    For the most part, the credit card companies take the loss. As much as it goes against my grain to compliment a company, my hat is off to them. Since long before the internet became a player in the economy, they have very carefully been calculating the losses from fraud for each new venture vs. the profit, and going in with an acceptance of that fact. If they lose $75 MILLION from vending machine fraud every year but make $400m in net profit, it's worth paying the losses. Better that than not going into business and losing that profit entirely.

  2. Re:there are better ways on Techie Fight Clubs Springing Up · · Score: 1

    Precisely.

    Organised sports provide this sort of outlet for most people. The traditional geek/nerd stereotype is exactly the sort who would have been useless in normal sports, making this a potential outlet for their aggression. Skill? Discipline? Tactics? Not really necessary when you can go into berserker mode.

  3. Re:Why not the SCA? on Techie Fight Clubs Springing Up · · Score: 1

    Hmm. Depends on the branch, but with proper armour, I know of many SCA groups that fight with proper steel swords.

    Me, I fence competitively.

  4. Re:Taking that example on Security Analysis Reports for Managers? · · Score: 1

    "The next cheap big improvement to suggest to someone running ssh is to disable password authentication (especially given all the brute-force login attempts we've seen). Then everyone who needs ssh access gets a nerdstick to put on their keychain (if they lose it they lose their house keys) with the private key."

    This is definitely a win from a security point of view, but the cost analysis is a tough one. How much does it cost for the keyfobs, the software to manage them, and the time involved in tying authentication to them? How much more secure does it make your system, and is it quantifiable? Put another way, let's say the likelihood of a break-in without the things is x%/year, and the cost of a break-in is likely to be $y dollars. If you look at a long view of five years and find that the things cost the company more than y(1-((1-x)^5)), then it's generally not worth it. Furthermore, if it's a small cost benefit, then convenience and privacy should weigh-in. (One of my contracts just implemented fingerprint scanners on all of the PCs across the company--stupidest thing I've ever seen, and I've so far refused).

    "A lot of managers are already there -- they live in a world of tradeoffs and many of them know it."

    No doubt about that, but both managers and techies can fall into the binary solution mode: Something is either broken, or it's fixed. It's either insecure or it's secure. If we need to be secure, how much will it cost? Don't give me shades of grey, give me a PO that I can sign!

    No slight intended against managers by my comment--I just meant that it is THE MOST IMPORTANT part of security, and something that doesn't often get applied to computer security as often as it should. It's one of those 'obvious' points that needs to be put in papers for the same reason that all of those 'obvious' technical definitions need to be there. Someone might not realise it, or they might have forgotten what the real target is.

  5. General plan here on Security Analysis Reports for Managers? · · Score: 4, Informative

    Here's how to write it as if you were an auditor. When it gets to the auditors, they'll eat it up.

    First of all, the executive summary. "We are mostly secure/insecure, with (n) critical action items. Of these, (x) can be implemented with little effort or cost, (y) will require substantial effort and/or cost, and (z) will require a fundamental change in the way we do business." Actually, this breakdown might be a bit detailed for an ES. Yes, really.

    Then provide the background: "The internet is a scary place. (n)% of security breaches come from inside. Personal laptops can sniff unencrypted traffic. Passwords are easy to hack. Security breaches can undermine us in some specific way, or cost $xxxMM. etc.."

    Now the specifics: "Preliminary analysis of our network has uncovered some critical/significant/minor security flaws. These are blah, blah, and blah, in increasing/decreasing order of severity/cost-to-fix. A detailed analysis of these flaws is as follows:
    (flaw1)
    (flaw2)
    (flaw3)
    (...)
    The analyses should be broken down in a fair amount of detail, with technical terms defined in a glossary at the end of the report. Each one should contain the cost-to-fix and the cost-of-breach if possible, as well as the likelihood of a breach. Having a DMZ mail server taken down by hackers might be a huge pain in the ass, but ask (i)will it actually cost the company that much money in lost productivity, (ii)how likely is it to happen, and (iii)how much will it cost to improve? Alternatively, a disgruntled admin can potentially destroy your data centre--downtime at (d) dollars/hour, plus the cost of lost data since the last tapes. A third alternative is loss of proprietary data to a competitor, which might be bad, or might be enough to shut the company down permanently. Be VERY CAREFUL here, though: If you're writing a security analysis, then don't stray into trying to build an entire DR plan. Seriously. Don't.

    Summary: Exactly that--summarise the detailed analysis, ordered by the the cost/benefit ratio. Make sure that the difficulty of implementation or added risks are considered as well. Remember that at this point, you're just summarising the data, not yet doing the...

    Recommendations: "Based on the above data, we recommend implementing blah and foo immediately. These provide some/significant improvements in security, can be achieved with a minimum of effort or cost outlay, and carry little/no risk of introducing new problems. In the 1-3month timeframe, 3-6 months, 6-12..." That sort of thing.

    Then of course, the glossary.

    Don't ever forget: Security weaknesses are the cost of doing business. For example: Moving from telnet to ssh provides a significant benefit, and allows you to keep working. Shutting off all interactive logins doesn't provide much further benefit, and most likely substantially interferes with the company's ability to do work. Limiting ssh access to a few client boxes may provide a security benefit (hard to quantify), but may also increase the administrative overhead enough to make it not worthwhile. All managers and techs much understand that security isn't an absolute goal--it's a degree of risk acceptance. Eliminate all unnecessary risks (security or otherwise) be aware of all the necessary ones, and mitigate the risks as much as possible.

  6. Re:Ticketmaster shooting themselves in the foot? on Ticketmaster to Start Online Ticket Auction · · Score: 1

    The problem is that tickemaster has ties and agreements in place with promoters, advertisers, and venues. If you want to hold a concert at stadium "x" then you WILL use Ticketmaster. End of story.

  7. Re:So You're All Ticketmaster Genius' Now, Huh? on Ticketmaster to Start Online Ticket Auction · · Score: 1

    Here's a TicketMaster service charge for you:

    $6.25(+tax) for an $18 ticket. Assuming you pick it up. $8.00(+tax) to have them mail it to you.

    If you want to have them email you the confirmation number and print the ticket out yourself, it's only $4.00(+tax).

    Care to tell me how that's justifiable in any way other than "because we can!"

  8. Re:Why no attacks on US soil since 9-11? on Gonzales Says Publishing Leaks Is A Crime · · Score: 1

    Two things to keep in mind here.

    Bush's invasion of Iraq was orchestrated long before the September 11th attacks--before he was elected, in fact. Check out The Project for a New American Century, and make note of who actually founded it.

    Secondly, I believe (personal belief, no statement of fact here) one of the reasons there have been no further attacks on the US is that they've achieved their purpose: The USA is eating its own guts from the inside out, and destroying the economic, social, and democratic foundation of itself far faster than any external nation could.

  9. Re:Where do you go when freedom loses on Gonzales Says Publishing Leaks Is A Crime · · Score: 4, Insightful

    Where do you go? You stay RIGHT THERE, and FIGHT for your freedom, dammit!!!

    The US is quickly falling into a totalitarian state because of ONE REASON: The populace allows it. The PEOPLE are letting the government get away with this! YOU are letting the government get away with this!

    Gonzales supports torturing prisoners to get information. Rumsfeld, Wolfowitz, Cheney, and others selected Bush as their champion to invade Iraq and sieze control of the middle-east almost two years before he was nominated for the presidency. Oh, and let's not forget the US government deporting Canadian citizens to other countries where they'll be tortured, as happened with Maher Arar.

    Then consider how the government treats its own people: Spying on them illegally, trashing the first ammendment, and imprisoning them.

    Why are you letting these people walk through the streets freely? Why are you letting them run your lives? Why are YOU PERSONALLY not standing up against them, and fighting for everything that they're destroying, after two and a quarter centuries?

    Quit complaining. Fight for your lauded rights. Fight with words and law and accountability, or later on you'll be fighting with knives and guns and molotov cocktails.

  10. Re:Not so much... on Windows Media Player 11 and Urge · · Score: 4, Insightful

    What you're proposing would be a HUGE benefit for the consumer, a great win for the musician, and a disaster for the recording industry. The fighting, incompatible formats, backwards compatability issues, DRM, all help generate profit for the companies. That's the real reason they don't get together.

    When CDs first came out, the cry was "perfect sound forever." When audiophiles started to complain about the sound quality, the industry claimed that they were hearing things (with the exception of the high-end, who sold insane CD players). Now that the CD is standard and players are zero-profit commodities, they need to come up with a new format which forces people to buy new gear and replace all of their music again. Enter SACD and HDCD. Suddenly, the very people that used to tell us that CDs are perfect, are now claiming that the new format(s) are MUCH better sounding than crappy old CDs.

    None of this is intended to benefit the consumer or the musician. Let me repeat that: None of this is intended to benefit the consumer or the musician!" The music industry exists for no reason other than making money, and the most efficient way of doing that is to screw the consumer.

  11. Re:Why? on Windows Media Player 11 and Urge · · Score: 1

    Excellent point. Of course you lose some quality in recording an analog signal--and more again if you copy it, or redigitise it. EVERYONE knows that!!! Of course, hardly anyone knows just how much (or in fact, how little) degradation it will cause, even if they bother to think of it.

    The key here is that the music companies are working very hard to instill the 'no more analog' mindset into the populace. People are already forgetting that they're actually _listening_ to the music at the end of the day, and hence it can be copied. This is good for the companies--it forces the consumer to buy (or rent!) stuff that they could copy with a pair of mics and a good digital deck.

    Fundamentally, it's part of a deliberate attempt to remove the thought from peoples' minds.

  12. Re:URGE in practice on Windows Media Player 11 and Urge · · Score: 2, Interesting

    That's nice for you. Apparently you like giving money to your bosses unnecessarily.

    I get music from the library. I listen to music at the store before buying it. I borrow it from my friends. Paying to listen to it before paying to buy it is the sort of marketing that only makes sense if you don't think too hard about it.

    How about this: Maybe clothes stores should start charging rental fees to try on clothes before you buy them. Car dealerships can start charging rental fees for test drives. What a wonderful idea!

  13. effing wah. on Red Hat Not Satisfied with Sun's New Java License · · Score: 1

    So Red Hat doesn't like the license? Screw 'em--they can write their own Java, according to the open-source published code standard.

    Negroponte is religious about open-source (according to his own definition) only? Then he probably won't get nearly as far as if he used the tools available, with the licenses as is.

    Red Hat has been a blight on the world of commercial software companies, while spouting out BS about OSS that they don't even pretend to follow themselves. Fuck 'em all. My computer is no longer a religious shrine--it's just a tool.

  14. Re:Users are the lifeblood on The CVS Cop-Out · · Score: 1

    "Having been involved in a few projects myself, I can tell you what the *real* lifeblood of a project is: developer interest. As long as there is a community (which may be a single person) of developers interested in a project, and willing to donate their time and energy to it, the project grows and develops."

    Oh yeah. It all makes sense now.

    Of course without an interested user base, coding is just masturbation practice.

  15. Re:i call bullshit on US Releasing 9/11 Flight 77 Pentagon Crash Tape · · Score: 1

    Of course it is. Let's all repeat it again:

    9/11! Hard decisions! Terrorism. Iraq. Saddam Hussein. HARD decisions! 9/11. 9/11.

    Repeat until people forget what they were suspicious or unhappy about.

  16. Re:Bushy on US Releasing 9/11 Flight 77 Pentagon Crash Tape · · Score: 1

    You claim to not comprehend the constant search for 'more,' but then you hit the nail on the head, with your analogy to addiction. The human lives, the people to live or die, the soldiers and terrorists and enemies all come down to nothing more than ballast in the biggest game there is.

    Whoever dies with the most marbles, wins. That's all there is.

    THe scariest part is that the people playing aren't honest enough to realise that that's all there is.

  17. Re:No contest on Favorite Film Scientists? · · Score: 1

    'Back in the day,' much of the truly revolutionary science was mad science. Mad scientists generally have no one other than themselves to experiment on. Case in point: Issac Newton, who investigated the optic nerve by sticking probes behind his eyeball. Eugh!

  18. Who are these end users anyways? on Cutting Off an Over-Demanding End-User? · · Score: 1

    If these are real customers, then you have some obligation to them. If they're just the standard "friends&family," then screw 'em. Tell them that you don't have time.

  19. Re:A "promising market" on Mainframe Programming to Make a Comeback? · · Score: 1

    First of all, who scares you more, the USA or China? The answer for me is USA. China is at least pretty clear about what they want, and upfront. The USA is turning into a nation controlled by morallistic holy warriors, bent on world conquest.

    Secondly, consider IBM's history--they actively worked with the Nazis to develop the modern digital computer, for the sake of collating data on prisoners in the death camps.

    So this is neither surprising nor alarming, at least for me.

  20. Re:What makes a mainframe a mainframe? on Mainframe Programming to Make a Comeback? · · Score: 4, Informative

    To answer your question at least partly, look at something that Sun termed "midframe," the SunFire 6800.

    This beast can be physically partitioned into multiple domains. One OS runs on each domain. CPU/Memory boards and I/O boats can be dynamically moved from one domain to another. You can run Solaris 8 in one domain, Solaris10 in another, Linux in a third, and um...*BSD in a fourth. Any of them runs independently of the others. If a board dies, you can deallocate it from a domain, swap it out, and add it back in--all live.

    Now multiply that by a LARGE number, add crazy amounts of fault tolerance, and you're getting into the world of mainframes.

  21. Sign of desperation on One Second Ads Hoping To Grab Your Eyes · · Score: 1

    First of all, this is a sign of desperation from a major consumer-facing company. It could be GE or Sony or anyone else. The only difference here is that GE is advertising their advertising plans, rather than trying to be surreptitious like many other companies. This just means that they're smart enough to attempt publicity around their publicity--metapublicity, really. At any rate, it's a sign that advertising as we know it is dying. This is no surprise--advertising evolves fast, and things that were normal in the late 1970s are now unheard of. (Does anyone else remember the Kraft recipes during Love Boat?)

    However, it's also a sign of desperation from GE specifically. They are a sick company, with almost a decade of short-term thinking infecting them like a disease. They don't make decisions to improve the company, they make decisions to claim profitability in a quarter, regardless of whether or not they actually made any money!

    Take a look at GE's stock vs. the NYSE. They can't keep up to the conservative market indicators, which is a sign that they're adrift and lost. Having worked there for several years, I can confirm it--this is a company that needs to be gutted and rebuilt.

    Of course they're large enough that they're not going to go away any time soon, but at the same time, they're not going...anywhere. They're just grasping at straws to become relevant again.

  22. Re:What The Fu.... on John Dvorak's Eight Signs MS is Dead in the Water · · Score: 1

    Interesting points. Pretty much everything you say is right, which is just about why MS takes over the world so successfully. As a monopoly, they don't have to put any effort into getting a product release right. (They in fact do, but that's another story). Ultimately as a monopoly, if you crush the competition you will start to make money down the road.

    MS has enough money and power and control over the industry that they don't have to worry about actual products. That's why Dvorak is right, but dead wrong about the consequences.

  23. News item for the manufacturers on Last-Minute Delays Looming for HD-DVD Launch? · · Score: 1

    Hey guys, bad news.

    Nobody's waiting. Nobody cares.

    Get your shit together, come up with a single format that is backwards compatible, provides a clear benefit, and doesn't screw things up, and THEN people might raise an eyebrow.

  24. So getting hammered is STILL the point on Star Trek's Synthehol Now Possible? · · Score: 3, Insightful

    "...experience all of the enjoyable, intoxicating effects of alcohol without unpleasant side-effects..."

    Funny thing here. For me alcohol is a flavour and texture component of my favorite drinks. The volatility and solvent properties of ethanol make most alcoholic drinks impossible to fake--dealcoholized wines are wretched, non-alcoholic beer if carefully done can rise to the level of almost mediocre, and dealcoholized hard liquor is an oxymoron.

    For me and many others, the "enjoyable" effects are not the "intoxicating" effects, and in fact the latter often fall under the category of "unpleasant side-effects."

    This is just another drug to get stoned on. Big deal. Personally, I'd stick to mushrooms.

  25. Re:It's not the Marketing - it's the OEM bundling! on Windows Vista Delayed Again · · Score: 1

    You're mostly right--OEM bundling is a huge part of it. However, OEM bundling is part of the MS Marketing program.

    Furthermore, MS has punished OEMs who don't ship the latest version--those price increases are a direct result of pressure from MS. (Similarly, MS charges OEMs more per license if they also sell a competing OS--this has been shown in the courts a few times.)

    FURTHERMORE...
    We have to consider the primary driving force in buying new computers. Not games, not failing hardware, but an OS that's designed to slowly bog down with spyware and application daemons and registry grief and general bloat. In a world of computer illiterate consumers, an OS as complex as XP is nearly impossible to keep running smoothly (by design!), and so people "have" to buy new computers every two or three years. If MS allowed old OSes to be sold as long as there was demand, then people would eventually discover that they didn't need faster machines, they just need clean ones.

    If you fixed these two problems, you'd invigorate the field of computing, and gut the home computer industry. Too many companies can't afford that.