Slashdot Mirror


User: fuzzybunny

fuzzybunny's activity in the archive.

Stories
0
Comments
936
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 936

  1. Good Wireless Tools Resource on 'BlueBag' PC Sniffs Out Bluetooth Flaws · · Score: 1

    Max Moser and some of the guys at remote-exploit have a few great tools and collections for wireless sniffing (all types, including bluetooth) such as the Auditor Collection.

    Just a blatant plug for a friend, check it out. I think it's pretty cool.

  2. Re:It's like the full disclosure question on Busting People for Pointing Out Security Flaws · · Score: 3, Informative

    Full disclosure: if I find a bug in, say, Windows, should I

    "Standard practice" among my colleagues who do vulnerability research is to report to the manufacturer of the product first, give them 30 days notice to fix and deploy patches (or _maybe_ longer if the manufacturer can come up with plausible reasons why not to release the vulnerability), then announce publicly to bugtraq or another forum. If you announce before that, it's considered sort of rude.

    That said, remember that bug finding is at core a prestige game, so you want to make sure you get credit for finding this sort of stuff before, say, secunia or another group either stumbles on it, or the manufacturer decides to disclose on their own. I don't know how you'd go about this, to be honest.

    If I find a bug in USC's website, should I

    Report to USC; if they don't take action, report it to someone else at USC. USC is a private company and it's their prerogative to take action or not; unless the bug affects you directly or is in the public interest, let it lie. An example would be if you're a student and your personal data are at risk, in which case you should forward a paper trail to, say, someone at the California Dept. of Education's legal group, and only go public with it if they don't act.

    Pretty much the same goes for your employer's systems.

    If you mean "systems" in the sense of "services/products they sell to others", and your employer won't take action on a known flaw, that sort of goes under the category of "products", which you're probably going to be under an NDA not to disclose. If your employer is lame enough to not do anything about it, find another employer if you're unable to escalate it.

    You can always pass it on anonymously to someone who will report it. Unless you're in it for the bragging rights, that is.

  3. Pretty Typical Trend, Actually on Higher Education Fears Wiretapping Law · · Score: 1

    "[Department of Justice] notes that it is willing to work with representatives of certain classes of service providers, such as schools, libraries and research networks, on solutions that would apply to narrowly tailored and well-defined categories of providers and would clearly identify sufficient alternative means of addressing the needs of law enforcement,"

    1. Introduce sweeping, over-generalized assault on freedom from potential massive abuse of law enforcement power (but won't someone think of the children?)
    2. Agree to "compromise" in the face of horrified opposition; compromise would, on its own, already have been discounted as "egregious".
    3. .....
    4. Profit!

    But hey, I guess our universities are already rife with criminals and terrorists.

  4. Nothing Wrong with CISA on IT Certification Less Important Now? · · Score: 1

    There is something odd about their inclusion of CISA--observing salary drops is one thing, but drawing conclusions about the certification's value is another. I can't really put my finger on what mistake they are making, but purely based on observational evidence, I can't imagine getting a "real" IT audit job without that certification.

    As for IT security-type stuff, certifications like CISSP have become sort of an "oh yeah, I have one of those" (I let mine lapse after getting sick of paying them 80 bucks a year for nothing) despite ISC(2)'s attempts to turn it into something that actually represents real knowledge. That said, I actually found the study material for the certification pretty interesting (neat insight into IT security management terminology and thinking.)

  5. Short Answer: "It Depends" on Open-Source or FIPS-Validated Disk Encryption? · · Score: 2, Insightful

    I'm looking at the same sort of thing right now.

    Open Source doesn't even enter our spectrum at the moment; I'm dealing with a client who's got a pure Microsoft shop (private bank) and who can't muster people to "play around" with things; they need to know that they can call a vendor and have them figure it out if they have a problem. Their support guys just don't have the time and/or clue to futz around with something if it breaks.

    Also, depending on their regulatory status, national laws, whatever, they may be required to present some sort of certification for various software components if audited. Thus it wouldn't matter if open source or not--rather, "certified or not". Whether or not the certification actually means anything is irrelevant. It'd be a case of you-know-and-I-know-but-do-they-know?

    That's not to say I wouldn't do open source--In a larger organization, one with more tolerance in terms of resources and clue, or one with a different end-user profile, I wouldn't be so concerned with implementing something, such as TrueCrypt, where I know it's a quality product and wouldn't be under such pressure to justify a decision to management and users (these guys are private client advisors, and there is _very_ little tolerance for any software screwups, and even less so if your ass isn't 100% covered.)

    So, "it depends". What are your legal/regulatory/compliance requirements? What's your user profile? What resources/clue do you have at your disposal? What's your use case? What's your management (the people who have to sign off on a solution) like?

    If any of these are in doubt, I'd start looking at things like Pointsec pretty quickly (don't know offhand if Utimaco works on Linux.)

  6. Re:Just Another Language on Is Corporate Speak Invading Your IT Department? · · Score: 1

    "Synergies": uh-oh. Sailing close to the wind here. That's a word that doesn't say so very much about the policy you're describing, as it says about you. It says 'I'm using fashionable management speak: promote me! I'm part of the club, just like you, boss!'

    Not to be a pedant (oh, fine, I am) but http://dictionary.reference.com/search?q=synergy sounds pretty legit for a lot of situations I encounter.

    Note, I don't work in operations, testing or R&D -- I am (*groan*) a consultant, so I do kinda get paid by people to help them figure out what will work best. Note my careful wording -- not to tell them what works best, but to sort of hold their hand on the way there. It's definitely true that fewer of these terms apply directly in the more hands-on parts of IT, but I'm very careful not to instinctively disdain some over-generalized category of "management-speaks" used by "the suits", some of whom can (surprise!) actually be pretty smart people.

    Where I agree 100% with you is a loathing and scorn for mis-use of fashionable terms purely to look good. Your terms "whoring" and "corrupting" are dead-on. However, many techies I encountered are just as bad as "the suits" when instinctively turning off the moment someone uses a term they pigeonhole as being business b.s. without really taking a moment to think about whether it might actually make sense.

    So conceptualize that value-added actionable proposition on a going-forward basis, team!

  7. Just Another Language on Is Corporate Speak Invading Your IT Department? · · Score: 1

    Think of it as just another scripting language to learn.

    There's management-speak and there's bullshit.

    Management-speak isn't necessarily bad. As another poster stated very correctly, a lot of these words and phrases have real meaning, although I've banned my girlfriend, who's a pretty high-level strategy consultant, from using "input" and "feedback" in a personal context.

    Assuming you're a smart cookie, you can pick it up and figure out for yourself where the boundary lies. "Risk", "framework", "synergies", whatever, all have their place. "Realignment" instead of "layoffs" does not.

  8. Re:Wait a minute... on RIM Chairman Wants Changes to U.S. Patent Law · · Score: 2, Interesting

    The phrase you're looking for is "my enemy's enemy is my friend".

    Regardless of what stupid, immoral, abuse of the very same patent/copyright/trademark system they committed in the past, if they now turn around and say "the system is b0rked! Fix it!" however selfish and hypocritical their motivation would be, they still have a point.

    Imagine Microsoft coming out, guns blazing, against buggy software, vendor lock-in, software monopolies, immoral and anti-competitive tactics and sundry other things for which they've been (rightfully or not) crucified in the past. Would you say "bah, it's Microsoft, fuhgedaboudit"?

  9. Been there... on Pair-Programming with a Wide Gap in Talent? · · Score: 1

    I've been in this situation, but on the clueless end (I still can't program my way out of a paper bag.) I thankfully had a pretty smart partner who just "got it", and who was willing to take the lead with the problem solving.

    We did our work sitting together at his PC; he made sure to constantly ask me if I understood what he was doing, to give me smaller chunks of the problem, and to try to lead me along.

    I don't know how you define "doing all the work", but he was certainly the active party. I learned a lot from our assignments, and was extremely grateful to him for leading me out of dead ends, correcting my stupid mistakes, and generally coaching me.

    If your instructor frowns on this sort of thing, I question his academic seriousness; it's always been my impression that assignments and tests are as much learning experiences as lectures or studying.

    I know this is sort of a blue-eyed optimal scenario, but if your partner is willing to work with you and take an active role, it's really cool for him to have someone with clue to guide him along, and would probably be good experience for you in terms of coaching and tutoring.

  10. Go nuts around money-counters on Cocaine Biosensor · · Score: 2, Interesting

    Maybe they could install these in banks and have them thrown out after about 5 minutes because the staff were going nuts about the constant beeping every time they counted $100 bills...

  11. Re:Chris Rock and Colin Powell on 1001 Islamic Inventions · · Score: 1

    "Whenever Colin Powell is on the news, white people give him the same compliments: 'How do you feel about Colin Powell?', 'He speaks so well! He's so well spoken. I mean he really speaks so well!' Like that's a compliment, shit. 'He speaks so well' is not a compliment, okay? 'He speaks so well' is some shit you say about retarded people that can talk. What do you mean he speaks so well? He's a fucking educated man, how the fuck you expect him to sound, you dirty motherfucker? 'He speaks so well.' What are you talking about? What voice were you expecting to come out of his mouth? 'Imma drop me a bomb today', 'Imma be Pwez o dent!'."

    Well, considering the other cretins that usually pass for candidates these days, I think "he speaks so well" is a pretty glowing compliment.

  12. Reminds me of Goodness Gracious Me on 1001 Islamic Inventions · · Score: 1

    In this BBC sitcom, done by Indians making fun of Indians, there was a recurring skit about a sort of pseudo-nationalistic Indian preppie/geek at an English university. Every time something new or even vaguely interesting came on TV, was mentioned, whatever, he'd say "I bet you think that was invented by the English, don't you? Think again! Indian!"

    It became hilarious when he'd start ranting about "the Queen? Indian!" and the likes.

    This seems to me to be sort of a mix between that, and, given that it's The Guardian, a "no, we don't hate Islam, please don't blow us up, we distance ourselves from any, ahem, cartoons".

    I'm not saying a lot of the content isn't legitimate and correct, but the context and timing strikes me as sort of, uh, questionable.

    I'm wondering where the parallel articles about inventions from ancient Egypt, China, INDIA!, whatever, are?

  13. Re:Safely approach? on Covert CCTV Monitoring in the Workplace? · · Score: 1

    You've obviously never worked for an English manager, I tell you man, those bastards are ruthless :-)

  14. Re:If they're good enough for the Space Shuttle... on Linus Says No to 'Specs' · · Score: 1
    There's a reason for this. Same with medical devices--you want something to behave in a predictable, reproducible manner, otherwise someone dies.


    This means an enormous amount of overhead for project management, code analysis, documentation, testing, QA, reviews of testing, reviews of documentation, signoffs, etc etc etc.


    It's not adventurous or fun, it doesn't remove 100% of problems, but it makes it easier when religiously followed to find where issues come from and how to fix them.

  15. Re:El Al has the right idea on Wireless Devices Could Foil Hijack Attempts · · Score: 1

    Why would you need access to the cockpit from the cabin, or vice versa, during the flight anyway?

    So the stewardess can run up to tell the pilot his intercom is turned on while someone in the cabin yells "lady, you forgot the coffee!"

  16. Re:My question is this....... on Authors Guild Sues Google Over Print Program · · Score: 1

    Yeah, but, no matter who's right or wrong on this issue, a lot of the works they're suing about were not produced with tax dollars.

    I totally agree with you on free publishing of anything and everything that took public money to create. One could argue that you shouuld be able to copyright a certain type of presentation or collection of, say, laws, but not the texts themselves.

  17. Re:Dam that is some plague..... on World of Warcraft is Infectious · · Score: 2, Funny

    Ah, right, I knew there was a good side to hanging around my apartment in my free time playing games instead of going out jogging.

    My girlfriend with giggle about my gut when SHE's dropping from plague, ha ha.

  18. Re:Emedding chips will not stop ID theft on New Identity Theft Technology Fails to Protect · · Score: 1

    And as another poster has put it so clearly, why do we even NEED credit cards?

    You want the lag time; a lot of credit cards give you a security mechanism insofar as it's the merchant's responsibility to verify the identity of the purchaser. You can dispute a fraudulent transaction; the CC company subsequently nails the merchant for it. I doubt that this would be as easy with a direct debit transaction, where the money is already in the hands of the merchant.

    CCs are also a very good mechanism for security deposits without having to resort to giving actual money to, say, a car rental company in Mexico; if they decided to screw you and not give back the $500 they've blocked off your card as a deposit (after your holidays ended and you've gone home) you'd probably have a more difficult time getting your bank to retract the payment than just calling Visa and saying "yo, fuhgedaboudit".

    Furthermore, a lot of people enjoy having an amalgamated monthly overview of their transactions _before_ actually paying their bills (I do), while CC companies love the exorbitant interest charged for non-payment.

    So no, nobody "needs" credit cards, but they sure make life mighty convenient.

  19. Re:Test is getting outsourced to China on Google Lawsuit Exposes Microsoft Offshoring Deal · · Score: 1

    Nice anonymous troll. _My_ projects have always been successful, yes. I choose my projects wisely. None of them ever relied on offshore people for anything, mainly because I can judge quality better when I meet the people involved face to face. I don't bother with doomed-to-failure domestic projects either.

    Not a single project I've ever had the misfortune to encounter or to rely upon in the course of getting my shit done, and which relied on offshoring to a cheap-as-shit Indian or Chinese company managed anything near a success.

    Way to imply that I said "Indians are incompetent", why don't you read my post again. When you lowball on price alone, you usually get what you deserve, and I don't recall seeing anyone (although maybe it's happened, who knows) choose Infosys purely on quality of work.

    Maybe you need to get over it; I suppose next thing you'll tell me that ~8 years of observational evidence is wrong.

  20. Re:As a record store owner, on Australian Court says Kazaa Users Breach Copyright · · Score: 4, Funny

    For the record, I have smoked pot and hashish, I have taken the latter across national borders (I was young and stupid), I have shoplifted (a candy when I was 13), I speed on empty highways whenever I can, I've found money on the streets and not returned it, I slept with an underage girl (I was 17), I lie and cheat on my taxes as much as I can, have snuck into two movies after only paying for one, and I've copied CDs and allowed friends to copy parts of my mp3 collection (ripped from my CDs, but hey, that's life.)

    I also finance terrorism, smuggle fissionable material to al Qaeda operatives in Baluchistan, coordinate a major child pornography operation, smuggle kidnapped women for the purpose of injecting them with MASTER RACE SEED (tm) in my underground lair, and leave the fucking toilet seat up BECAUSE I CAN.

    But I guess the CD copying is what they're really interested in.

  21. Re:Easy solution to phone spam... on Verizon Fights Back Against Mobile Phone Spam · · Score: 1

    Yes, but this is called "international roaming". Calls to an Eirecom (?) phone in Germany from a Telefonica landline in Spain result in:

    -The telefonica caller being charged internationally to call an Irish cell phone
    -You being charged the additional "roaming" fees to re-route the call. These can be quite hefty.

    I have a Swisscom phone (in Switzerland, duh), and we do not have incoming call charges for the entire area of Swisscom coverage (throughout Switzerland, duh.) I believe the same applies to fixed regions, usually the country or parts thereof, for other formerly national carriers (T-Mobile, etc.) or private carriers within national areas. I think the national borders as a limit to how far you can receive unlimited incoming are more due to convention and technical/service evolution within pre-existing markets than anything else.

    Naturally this changes if you have a carrier that charges for incoming calls, such as (I think, but am not 100% sure) UK Vodafone, regardless of whether you're in-country or abroad.

    The US cell phone market is just extended throughout the country, and is not as insular between borders as in Europe, but rather between providers (Nextel, Sprint, whatever.)

    Plus, the US is a whole bunch bigger... :)

  22. Re:Test is getting outsourced to China on Google Lawsuit Exposes Microsoft Offshoring Deal · · Score: 1

    I can't see one comment on outsourcing that does not say that work was "F*@& up".

    I'm an IT consultant; I've worked for some pretty big firms. Not a single projects I've had that's dealt with outsourcing in India and/or China didn't have massive, horrible problems with being "F*@& up". Poor quality, people who wouldn't do jack shit without a work order in triplicate, semi-literate (no, not just the language barrier) "support" people, industrial espionage of the lowest, most horrible base, lacking basic security safeguards, rotten or nonexistent QA and long-term massive cost overruns disguised by "hey, we delivered _something_, so you're still saving money" are only parts of the picture. Also, a far-higher proportion than what I'm used to of people brought in from abroad to help with outsourcing have turned out to utterly useless, which is crap for the few good ones as they're lumped into the massive monkey-pot. To be fair, I've seen some excellent backoffice-type work done by various smaller Indian outfits, but that's about the sum of it.
    I for sure know that IBM would be getting its work done either in China or India.

    I've actually just had to deal first-hand with the result of this, and boy, let me tell you, no more IBM for me.

  23. Re:As a record store owner, on Australian Court says Kazaa Users Breach Copyright · · Score: 4, Insightful

    Hm, a family music store owner who cusses out kids, no matter how stupid in his store. Good one.

    Frankly, I haven't bought a single CD in about a year (no, I haven't downloaded anything either, I don't have the time, and my currently fairly extensive collection serves me fine on the few occasions I have a moment to listen to my tunes, like in the car on my way to clients'.)

    I'm sorry to hear about your business. My mom and I have both built up small companies individually. However, we've done so in areas in which there was demand. I've done my best to keep on top of that demand, and to adapt my services to what's required; as long as I can keep doing this, life goes on.

    However, if anyone was so fucking arrogant as to come up with something like a "blacklist", I would be the first to sign up for it voluntarily. As I've said, I don't pirate music; most of what's around today is too shit for me to waste time on. I've 3-4 CDs I've burned from friends, but compared to the ca. 700 I _bought_, you'll agree that these are peanuts.

    As I wrote in a letter to the head of consumer relations for EMI Germany when I realized that my girlfriend had bought a copy-protected disc that took me more than 5 minutes to rip a copy of so she could listen to it in her car without scratching the original, I will not subscribe to ANY goods or services from ANY company that treats me like a potential thief instead of a customer. I'm an honest individual, I'm smart and hard-working enough to be prosperous, and that's a pretty choice customer demographic. But hey, no EMI CDs for my girlfriend (who owns several) or myself since...

    However, I don't care how barefoot your children have to walk to school, if you, as someone who wants to sell me something (which you do not seem to) even hints at a threat, I will vote with my wallet. Maybe some of the 7-10 friends whom I will, as a statistically average consumer, ask to do likewise, will also avoid doing business with you. So what? You're not selling air or food or water. Maybe some of their friends will too. In fact, I've already noticed myself going to fewer movies just because the RIAA warnings and "no cameras" signs piss me off on principle. So what? There's cafes and books and girls in short skirts outside, I think I can deal.

    And you know what? I don't matter. I'm just one among millions. But act like an arrogant prick instead of someone who wants to woo me for the purpose of an honest exchange, no matter how hard you're being hit by '1337 p1r8 d00dz, and you may see that the ones among millions from whom you won't see a red cent out of general principle will add up.

    It's capitalism, survival of the fittest. With an attitude like that, no business has any right to exist.

  24. Re:Skype still rules the roost on Google, Skype and the Future of IM · · Score: 1

    It is the only client which encrypts all comunications end-to-end

    And you've had a close look at how this "more secure" "end-to-end" encryption works. Last I checked, nobody had bothered to formally release any elements of the Skype protocol (although this may have changed very recently) for public scrutiny. I won't bother pasting more than one link about how much we should trust proprietary / secret / super duper clever new encryption mechanisms that aren't openly available for analysis. Skype has already had a few fairly nasty publicized holes.

    It's interesting, y'know. ROT13 is also a form of encryption.

    Skype may be convenient to use (although I've had some utter misery with transmission quality for about 50% of my connections) but it re-invents the wheel in a lot of ways, not all of them good. I'm not, by any means, claiming that Google is any better (although TLS is a pretty mature, proven technology) but security certainly isn't the quality I would recommend it on over something newer, better and shinier.

    Although to be fair, from the little that I've seen, Google's means for dealing with proxies and firewalls seem pretty limited.

  25. Re:Did you really spend much time in the library s on College Libraries Without Books · · Score: 1

    Interesting point. In fact, I noticed this with a game called Netrek that I used to play in the early '90s at Cal (it's still around--the game and the University :)

    Basically, people got sucked into an open source game with a very flat learning curve and complex teamplay by going to labs and seeing people playing it during work breaks and late at night (despite a NO GAMES) policy that was spottily enforced by the "web trolls". A lot of the cultural aspects of the CSUA, a CS student social organization, also stemmed from people hanging out and working in close proximity to each other in these labs.

    When home PCs (and broadband in dorms) became more ubiquitous, a lot of this was lost; the geeks didn't hang out so much anymore. Interestingly enough, at about the same time you started getting an upsurge of people wanting to major in CS-related topics due to their perceived profitability in the dot-com market, so you got a far higher percentage of non-hardcore-geek types who just did the academic work and that was that.