Slashdot Mirror


User: dgatwood

dgatwood's activity in the archive.

Stories
0
Comments
14,277
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 14,277

  1. Re:God Dammit on Senate Confirms Neil Gorsuch To Supreme Court (washingtonpost.com) · · Score: 2, Informative

    They really didn't steal it. Would you have rather them just vote every person President Obama nominated down?

    Yes. Because then they would have to justify that decision to their constituents. By refusing to schedule a vote, they were able to blame the people at the top and avoid taking any responsibility for their failure to do their constitutionally mandated duty. They chose the cowards' way out rather than face the voters. Make no mistake. Every single Republican in Congress who did not have the courage to demand a vote last year is a pathetic coward, and deserves no respect whatsoever.

  2. Re:Not a terrible thing on The iPhone 7 Has Arbitrary Software Locks That Prevent Repair (vice.com) · · Score: 1

    If you accept data from untrusted sensors, an attacker could replace the sensor with a device that will store valid finger scans and retransmit them when triggered by the attacker.

    Who said anything about accepting data from untrusted sensors? Trust should not mean trusted by Apple, because it isn't Apple's device once it arrives in a user's hands. It is the user's device, so the user should decide whether a sensor is trusted. That means if the user intentionally replaced a broken sensor (or broken screen with the sensor attached), then the sensor is trusted, or at least should be.

    However, the user should be altered to the fact that the sensor has been replaced, and should be forced to set up fingerprint recognition again, ensuring that if the user did not request replacement of that part, the user will realize that somebody is actively trying to steal access to his or her device. Such an approach in no way breaks the trust model, because the user knows whether he or she took that device in for repair.

    In other words, I don't object to trusted firmware or a secure pairing process. I object to the secure pairing process being triggerable only by external tools, rather than being able to trigger it from within the operating system while the user is signed in with a passcode. If an attacker can get past that hurdle, then the attacker already has access to the phone and does not need to compromise the reader/secure enclave, realistically, making any protection beyond that level completely moot.

    I mean, I suppose in theory, you could have a cabal of untrustworthy repair shops that use deliberately altered readers so that they can steal the phones a week later and gain access to the users' data, but that would be a pretty crazy thing to try to guard against, for any number of reasons, not the least of which is that a wrench is likely to be just as effective.

  3. Re:Secure by design on The iPhone 7 Has Arbitrary Software Locks That Prevent Repair (vice.com) · · Score: 1

    Well, any such repair would involve shutting off the phone, so the user would know that the phone had been turned off. That said, it should be more obvious to the user than that. Nuke the fingerprints and require the user to reset them. Make it painful enough that the user will ask "Why the h*** am I having to do this" and will go online to look it up. That way, somebody swapping the part without the user's knowledge will set off actual warning bells in the user's head.

    What makes it bad is that neither the user nor third-party service centers can do this "recalibration". It should be very nearly automatic with nothing more than an alert on the user's screen ("Your Touch ID sensor has been replaced. You must reprogram authorized fingerprints before you use Touch ID.") every time the user attempts to touch the Touch ID sensor until they add the first fingerprint (thus proving that they have the passcode and can unlock the device). This gives the same security protection without raising right-to-repair issues.

  4. Re:Not a terrible thing on The iPhone 7 Has Arbitrary Software Locks That Prevent Repair (vice.com) · · Score: 5, Interesting

    This does not seem unreasonable. I say this because the home button is also a fingerprint reader, which is a security device. If a shop installs some kind of 3rd party button there, the security of the device could be compromised.

    Actually, it does seem unreasonable. The proper behavior would be to detect the unknown reader and purge all fingerprints from the secure enclave, forcing the user to set up fingerprint recognition again after unlocking with the passcode. That would mean that the user would be alerted to the fact that the hardware was altered (thus preventing surreptitious swapping as a targeted attack) while still allowing the device to be repaired by swapping hardware at the user's request.

    The current situation is exactly the sort of behavior that got car manufacturers a very nice set of laws that mandate repair part availability, etc. Keep going down this path, and Apple will earn the consumer electronics industry a similar set of regulations, and none too soon.

  5. Re:Apple's Response on Apple Taken To Court For Refusing To Fix Devices (bbc.com) · · Score: 0

    I think you mean "worse than".

  6. Re: Hitlery will not be running for office on Bannon Loses National Security Council Role in Trump Shakeup (bloomberg.com) · · Score: 1

    There is only one problem with your argument, and it it's this: Hillary actually DID win the election, so claiming she was too "whatever" to do so flies in the face of reality.

    No, she didn't. She won the popular vote. However, our constitutional republic is deliberately set up in a way that gives smaller states a disproportionately large vote to ensure that candidates can't just focus on the needs of the big states, and as a result, Trump won the election because of his claim—ridiculous as it might be—that he would bring back manufacturing jobs to those smaller states.

  7. Re:Has he been shrooming with Trump or what? on FCC's Ajit Pai Says Broadband Market Too Competitive For Strict Privacy Rules (arstechnica.com) · · Score: 2

    There's a lot of competition in broadband... in areas where rich people live. That's why the apartment complex a block away from me (only affordable by software engineers) has gigabit fiber, cable, ADSL2, "Ethernet", and half a dozen other options, whereas the mobile home park where I live (just a block away) that has a broader mix of demographics has only Comcast and ADSL2 (at single-digit Mbps with abysmal uplink speeds).

  8. Re: Hitlery will not be running for office on Bannon Loses National Security Council Role in Trump Shakeup (bloomberg.com) · · Score: 4, Interesting

    Hillary Clinton was barely tolerated by half of the Democrat voters. That's why Hillary lost. Trump was a barely tolerated candidate among Republicans, but not quite weak enough to be defeated by Hillary Clinton. For example, take a look at her first-amendment positions and you'll see someone who is way to the right of center. When you have a choice between a Republican running as a Democrat and a Libertarian running as a Republican, is it any surprise that the latter wins?

  9. Re:How Much Salt? on Graphene-Based Sieve Turns Seawater Into Drinking Water (bbc.com) · · Score: 1

    There are 16 ounces to a pound, not 8, so it's half that. Still, that's a lot of salt.

  10. Re:Only in America on Bidding Website Rentberry May Be the Startup of Your Nightmares (gizmodo.com) · · Score: 1

    On the other hand if it goes for less I ask for 1200/mo and only get 1000/mo then the renter got a good 'deal' of 200/mo off and will have to pay them 25% of that discount. They still got a good 'deal' that they wouldn't have otherwise.

    Except that part isn't true. It naïvely assumes that the renter is too scared to contact the owner and propose a lower price. There are really only two scenarios that are realistic:

    • Someone is willing to pay the asking price within a reasonable time after the listing is posted, before the owner gives up asking for that price and becomes willing to accept a lower price. In this case, even with this service, it will still bring in that price, so the renter won't get a "deal".
    • Nobody is willing to pay the asking price, and if you offered a lower price to the owner, the owner would have accepted it. So the renter gets 25% less of a deal than he or she would have by negotiating with the owner privately.

    I fail to see how renters benefit from this website at all. It's basically a huge win for rental property owners, at renters' expense, and even if they didn't charge the renters, that would still be true. The whole "charge the renter" bit just means that they're screwing the renters twice—once by driving up the median rental price and once by ensuring that even crappy properties that won't rent for the asking price still cost more than they otherwise would have. For renters, it's a lose-lose.

  11. Good luck getting broad adoption of the needed security mechanisms in any other way. Remember, even banking websites generally do the minimum security work required by law and/or their contracts with credit card companies.

  12. What does requiring websites to provide browsers with a mechanism for updating passwords programmatically have to do with preventing pseudonymity? The two are completely orthogonal.

  13. Re:For mobile on Telcos Gear Up To Fight Facebook and Google Over How You Log Into Websites (mashable.com) · · Score: 4, Insightful

    The only thing I want less than Facebook vouching for my identity (and thus being able to impersonate me, see everything I do, etc.) is my ISP doing so. We're already in a situation where the privacy protections that prevented ISPs from horribly abusing that power just got shot down by Congress. And many ISPs have a long history of treating privacy as an afterthought (at best).

    What we need is not federated logins. We do not need a single password on a server somewhere to be the keys to the kingdom. This is a breach of proper security design at a fairly fundamental level.

    No, what we need is a law requiring all U.S. websites to A. allow autofill, B. always provide username and password fields on the same page (none of this "ask for the username, then click, then ask for the password" crap that breaks many password autofill systems very badly) and C. provide an HTTP(S) header containing the URL to an HTTPS endpoint that returns a form with four fields: username, old password, new password, and some standard checksum scheme to ensure that the form values were not truncated in transit. The form can, at the website's option, either use JavaScript (if the auth scheme requires client-side processing) or not (99.9% of websites), but submitting it must change the password unless the original password is wrong, and must trigger a full page load of a page containing exactly the text "403 FORBIDDEN" (in plain text, and nothing else) if the password change failed. (In the case of JavaScript-driven auth, this could be as simple as changing the location to /403.txt after getting back an error.)

    As soon as all websites conform to that standard, passwords basically cease to be a problem. Your in-browser password manager (whether the one built into the browser or your choice of third-party extensions) can just have a "change all" button so that if your passwords get compromised somehow, you can change them all to random values and optionally sync them with whatever cloud password system it uses.

    And any servers that are serious should also use cookies to keep a per-device token with some sort of callback-based verification (phone, text, email) before allowing the device to join. Such tokens should be automatically refreshed if needed as part of the password change mechanism so that changing a password doesn't invalidate the current device (and ideally should not invalidate other devices on the account). Such a website should provide a way to log out other devices. That sort of thing should, of course, be entirely optional, and is orthogonal to the password management issue, though perhaps such features should be required for any website that stores bank account numbers (not CC numbers) or provides access to bank accounts, stock portfolios, or retirement plans.

  14. Re:Operating System on Study Shows Laptop Batteries Often Don't Last As Long As They Say (digitaltrends.com) · · Score: 4, Interesting

    One obvious difference between Apple and the others is the operating system. Could MacOS better manage the battery than Windows? It would not be surprising that MacOS enjoy a better integration with hardware

    I think it would be more accurate to say that Apple has aggressively throttled a lot of common power pigs (e.g. plug-ins) and tends to discourage apps from running their own updaters and other crap in the background that keep the CPU from idling. If you could actually halt all those background tasks in Windows, I'd imagine it would handle power management about as well as OS X does, give or take. The problem is that everybody's Windows laptop is so loaded up with Antivirus crapware and other background tasks that the CPU never comes close to reaching an idle state....

  15. Re:Well, no shit Sherlock. on Study Shows Laptop Batteries Often Don't Last As Long As They Say (digitaltrends.com) · · Score: 2, Insightful

    The problem is that they're accurate, but only for the sorts of things you could do just as easily on an iPad—light word processing and web browsing. As soon as you get into things that laptops really shine at—photo editing, video editing, compiling, etc., the battery life drops to maybe a third the rated power. I mean Xcode, oy, but even without adding that giant pile of CPU piggishness, Lightroom, Finale (music composition)... everything I do in a typical day other than web browsing falls into the category of things where battery life sucks, and that's being generous.

    Why can't Apple make a laptop that gets more than 2.5 hours of typical battery life under load?

  16. Re:We've seen this coming... on ESPN Has Seen the Future of TV and They're Not Really Into It (bloomberg.com) · · Score: 4, Insightful

    To quote Steve Jobs, "If we don't cannibalize ourselves, someone else will."

    The reason large companies eventually collapse is almost never because they make stupid mistakes or because they fail to churn out new products, but rather because they start to fear innovation; when part of their product line becomes too lucrative, they begin to fear that their next product will undercut their cash cow, forgetting that the money still goes to the same place, like taking rocks from the underside of a cliff and cementing them to the top side.

    To prevent that undercutting, they build up silos that keep anyone from building up the land (money pile) under the cow, preventing the sorts of innovation that would otherwise keep them on the cutting edge. Instead, other companies create products that whittle away at the cliff underneath the cash cow and start making their own cow cliffs thicker, and in the end, all the big company has left is a falling cow.

  17. Re:25 years on AT&T Receives $6.5 Billion To Build Wireless Network For First Responders (reuters.com) · · Score: 3, Interesting

    By any sane standards, this is a complete waste of money. What works best for first responders? Point-to-point radio communications. Walkie talkies. All these systems didn't work because the systems were incompatible, and the reason they didn't all use the same system was that none of the systems were significantly better than any others, and each organization bought its radios on separate contracts from separate companies at different times, and short of a major emergency, there was no real reason to replace all of those radios with new ones just for a small increase in compatibility.

    Adding infrastructure just creates new points of failure, and when things go seriously wrong, the infrastructure will be nonfunctional, at which point everybody will go back to those incompatible radios, because they work by themselves, without any outside support. Short of AT&T designing a true mesh network for independent, moving radios, this is just a parallel cellular network, with all the problems that a cellular network has, only with lower usage and less financial incentive to expand the infrastructure and keep it up-to-date. And remember that those radios, despite incompatibility issues, mostly worked, whereas on 9/11, the cell network was DOA. Now imagine a world where they tried to use a parallel cellular network just for them, that (unlike the public cell network) never got regular load testing except during actual emergencies.

    My advice? Follow the money, figure out which politicians were bribed in exchange for funding this giant boondoggle, then vow to never elect any of them again. Rinse and repeat until politicians are clean again.

  18. Re:It has a security hole every week on What Killed Adobe Flash? (daringfireball.net) · · Score: 1

    This is no longer true, And via eMail or a web browser and cut/paste this was always possible anyway.

    Actually, it very much is still true.

    3.3.2 An Application may not download or install executable code. Interpreted code may only be used in an Application if all scripts, code and interpreters are packaged in the Application and not downloaded. The only exception to the foregoing is scripts and code downloaded and run by Apple's built-in WebKit framework or JavascriptCore, provided that such scripts and code do not change the primary purpose of the Application by providing features or functionality that are inconsistent with the intended and advertised purpose of the Application as submitted to the App Store.

    This is the current policy as of today (2017-03-30).

    But there are plenty of Applications, e.g. "CS At Once", that directly download JavaScript Code from the internet (and install it as a local library)

    Apps running JavaScript code do not provide their own interpreter. They use the JavaScript interpreter built into iOS. All the rest of your examples fall squarely into that exception. None of these things are relevant to the issue of Flash.

    There are several browsers that just do that, in the Apple AppStore.

    No, they do not. Please read my previous comment about how those apps work. Some might try to use one of the experimental Flash-to-JavaScript transpilers (Shumway or Swiffy, neither of which is still in active development), but those only works for a subset of Flash apps. Others run Flash on a remote computer (e.g. Puffin uses Adobe Flash-Over-Cloud). Others just do Flash video DRM using their own code. None of them run a native Flash interpreter on the device. None of them. And when you're talking about full compatibility, that's the only approach that actually works robustly. Adobe, Google, and Mozilla all tried other approaches to work around the iOS Flash blockade, and none were fully successful.

  19. Re:I hope this trend continues. on FCC To Halt Expansion of Broadband Subsidies For Poor People (arstechnica.com) · · Score: 1

    Yeah no, not buying that if you actually believe anyone chooses to be poor. But I'll pretend for a second you aren't lying. If you work hard, but don't have the opportunity to make a better life for yourself, you will still be poor.

    Everyone has opportunities if they know where to look—even people barely scraping by on minimum wage. They just have to make the right decisions by the time they reach high school—living with roommates to keep their costs down, waiting to have kids until they can afford them, and saving every penny they can so that they can afford to go to college. Once they've passed that hurdle, it gets somewhat easier, but many never even get to that point, in large part because nobody instilled in them the importance of saving money.

    Mind you, the poor don't have the same opportunities, and it is harder for someone starting out poor—particularly if their parents are also poor—but having fewer opportunities is not the same as having no opportunities, which is why I think it's important to spend at least as much effort at educating the poor to take advantage of the opportunities that they do have as we spend on trying to artificially create additional opportunities (which is, at best, a temporary solution that only helps the current generation and must be continuously funded).

    And learning money management skills isn't just important for the poor. I've known highly intelligent people working in high tech who are at both extremes—people who spend almost every penny that they earn on getting new cars and computers almost every year, and people who are the polar opposite, never buying a new car because they don't want to lose half their investment in the first year. One of those groups is going to be in a position to retire early, and the other is probably happier right now. On the one hand, you want to retire early enough to enjoy your retirement years. On the other hand, you could die in a car crash the day before retirement and not get to enjoy any of your savings. It's a trade-off.

    The important thing is not the particular balance of spending versus saving that any given individual chooses, but rather that the individuals intentionally made the decision after carefully considering the alternatives by looking at the numbers after gaining enough knowledge to understand the ramifications of their decision.

    Every dollar that you put into a 401k at age 22 will be worth more than twenty dollars at 65 (statistically). So whether your personal goal is to retire at forty or live a more luxurious life and work until you're 70, whether you plan to have no kids, one kid, or ten kids, it is important to start thinking about financial planning for retirement by the time you take your first job. Unfortunately, many people (both rich and poor) don't do that. The critical difference is that people with high income can mostly get away with burning through most of their income, whereas people with low income can't. And that's why we need to spend more effort on financial education of our young people; education is the great leveler.

  20. Re:I hope this trend continues. on FCC To Halt Expansion of Broadband Subsidies For Poor People (arstechnica.com) · · Score: 1

    They and their children are raised to execute suboptimal reasoning.

    I don't think suboptimal reasoning has anything to do with it. For the most part, ignoring people who are poor because of some disability, most poor people are poor because they were not taught good money management skills by their parents, and therefore made bad financial decisions at every possible opportunity by doing what their parents did, with each bad financial decision making things worse for them.

    I think that if you presented money management skills to those same kids early on, they would easily be able to handle the actual reasoning required to recognize that those skills are valuable and are a way to avoid being poor long-term. So the real problem is that nobody bothers to give them the facts required to start that reasoning process in the first place, and by the time they realize it, they're deep in debt and their bad habits are so ingrained that it is hard to change them.

    We haven't had true home economics classes in high school since my parents were kids, and it shows. We need to bring that back. However, even if we do bring that back, it still isn't enough. IMO, money management skills need to be taught in school starting in first grade when kids learn how to count currency. That way, kids who don't learn those skills from their parents still stand a fighting chance. All it takes is one teacher to change a child's future.

  21. Re:Hmmm on Verizon To Force 'AppFlash' Spyware On Android Phones · · Score: 1

    Yup. I wonder how much Verizon had to spend to buy that law so they could ship this "tool".

  22. Re:It has a security hole every week on What Killed Adobe Flash? (daringfireball.net) · · Score: 1

    Congratulations. You are technically correct—the best kind of correct.

    Let me clarify my original comment slightly. iOS App Store policies explicitly forbid the use of interpreters to run scripts downloaded from the Internet, and always has since the very first version of that document. It is technically possible to build apps that use a Flash interpreter internally to run Flash scripts that are bundled into the app. However, it is not possible to provide a generally functioning Flash Player Plugin on iOS, nor is it possible to provide general-purpose Flash support in a browser on iOS without jailbreaking or requiring users to build the app themselves.

    The only apps that "support" Flash actually either A. support flash video only (by not using Flash to do the playback) or B. "support" Flash by running the Flash code on a desktop computer and streaming the video. The former is limited to only certain types of content, and the latter is a horrible bandwidth hog that still isn't 100% functional. No apps are actually running arbitrary, downloaded Flash content on the device.

  23. That's what they say, but it's misguided..you can block data from Google or Facebook. You can't from your ISP.

    You're close, but your wording is slightly off in a subtle but critical way. It really has nothing to do with blocking Facebook. You choose what information to share with Google and Facebook. All of your Internet communication is routed through your ISP, so apart from using things like VPNs to explicitly block their access, they basically own access to all of your traffic.

    You can choose to use a different search engine if you don't like Google's privacy policies (*). You are not in any way obligated to post every little detail of your medical history on Facebook for everyone to see. But your ISP sees all unless you explicitly prevent it. That makes it much, much more important to have privacy protection that prevents abuse by an ISP than it is to have similar protections that apply to any arbitrary website.

    Now obviously to the extent that Google and Facebook run ad networks, they are more capable of monitoring you than most websites, but still way less than ISPs (*).

    (*) Unless, of course, Google is your ISP.

    The biggest irony, of course, is that staunch advocates of government surveillance just passed a law that pretty much guarantees everybody who hasn't moved to HTTPS will do so, and even had my aging parents asking about personal VPNs. Talk about the government shooting itself in the foot... but I digress.

  24. Re:It has a security hole every week on What Killed Adobe Flash? (daringfireball.net) · · Score: 1

    There has never been any version of Flash available for iOS, bundled or otherwise, because Apple doesn't allow any third-party interpreters on the iOS platform. (Maybe you're thinking of when they stopped shipping it preinstalled with Safari in OS X?)

    SJ's refusal to allow it on the iOS platform was the final nail, though you're correct that Adobe's mismanagement caused a low-quality product that mostly built its own coffin.

  25. Re:Flash killed flash. on What Killed Adobe Flash? (daringfireball.net) · · Score: 1

    They literally did everything they could do to avoid improving the product. Little surprise that it eventually failed. They frequently spent more time and effort explaining why they couldn't fix something than it would have taken to fix it. Gross mismanagement doesn't even begin to cover it. I'm amazed Adobe is still in business. Then again, IBM....