Slashdot Mirror


User: fuzzyfuzzyfungus

fuzzyfuzzyfungus's activity in the archive.

Stories
0
Comments
15,204
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 15,204

  1. Re:smart tvs are not smart on Even the Dumbest Ransomware Is Almost Unremovable On Smart TVs (symantec.com) · · Score: 1

    It was even better than that: not only did it log what you watched, it went poking through anything accessible on the local network(via SMB or DNLA, if memory serves) and sent the dossier back to HQ.

  2. Re:Mine's Been Good on Even the Dumbest Ransomware Is Almost Unremovable On Smart TVs (symantec.com) · · Score: 1

    Are you equally pleased with Vizio's deep and intrusive interest in fingerprinting everything you display on your TV?

  3. Re:"Reset to factory settings" button on Even the Dumbest Ransomware Is Almost Unremovable On Smart TVs (symantec.com) · · Score: 2

    If you are using eMMC flash(not universal; but pretty common; since handling the ugly details of raw flash memory is annoying; and you pay a surprisingly tiny premium over raw flash for the controller); you can define multiple 'general purpose partitions', each with its own write protect status(including permanent write protect).

    I'd be utterly unsurprised if more than a few eMMC devices have defects of various flavors that make device-specific attacks on what are supposed to be one-time-writeable settings possible; but, barring a sufficiently motivated attacker, with enough privileges to send whatever malformed mmc commands are required to confuse the specifc eMMC part used in your device, it is fairly trivial to carve out a chunk of your eMMC device, write the restore image there, and then write lock it without needing additional packages, one of the intrinsically write-once flavors of silicon storage, or any other fancy measures.

    If you are really pinching pennies, and don't want to dedicate that much space on the onboard flash; you also have the option of making one or more user-accessible ports higher on the boot hierarchy than the internal flash(whether it be an SD slot, USB mass storage, or booting to fastboot or similar if connected to a USB host device). In that case you can shove all the storage requirements to some external location; while still making it virtually impossible to render the device unbootable.

  4. Re:"Reset to factory settings" button on Even the Dumbest Ransomware Is Almost Unremovable On Smart TVs (symantec.com) · · Score: 2

    Even if they were too stingy for the extra flash; something like this TV is going to have at least one USB port; possibly an SD slot or the like. Something as trivial as just looking for a suitably structured flash drive as the first boot device; and booting normally if one isn't present, would make DIY recovery trivial for anyone not afraid of 'download this and write it to a flash drive'; and allow even the technophobe to be mailed a flash drive/SD card; told to plug it in, unplug the TV,and plug the TV back in.

    I don't know if they just care that little, if they don't want to make it easier to remove the 'smart' TV spyware that is usually included, or what; but anything small enough to not have easy-to-use external mass storage probably has so little firmware that a backup would be vanishingly cheap; and anything large enough to have some user-friendly option would just need a bootloader that checks for recovery media first in order to be effectively impossible to brick. Doesn't seem that tricky.

  5. Re:Using Firefox Meantime on Second Root Cert-Private Key Pair Found On Dell Computer (threatpost.com) · · Score: 1

    I agree that not using the system-provided certificate storage is a disadvantage; but I'd be curious to know if you've actively had lousy luck with certutil, or whether it works but is more of a pain than just using group policy to manipulate the Windows-native store?

  6. Re:Unavoidable on Second Root Cert-Private Key Pair Found On Dell Computer (threatpost.com) · · Score: 2

    I'm sure that some don't end up in handcuffs simply because the backlog of unpunished actual-bad-guys is so long that nobody even thinks about going after the white and grey hats, unless they embarrass the wrong person or company.

    It's also possible, though, that they managed it by perfectly licit means: millions of people pay to have AV companies grovel over their files and send some amount of data back to the mothership; and since certificate problems will affect the behavior of any program that uses the OS-provided certificate store(which is most of them, Firefox being the major exception); anyone with access to a decent slice of web traffic can probably infer the presence or absence of a given certificate on every IE and Chrome user who passes through.

  7. Re:Unavoidable on Second Root Cert-Private Key Pair Found On Dell Computer (threatpost.com) · · Score: 5, Insightful

    The only consolation is that 'superfish' was clear evil, executed with some degree of effectiveness; while the current Dell thing appears to be unbelievable failure at even the concepts behind safe certificate handling; but without an overt evil objective.

    It is, at least, possible, that stupid will be cured by enough 3rd party testing; but evil is harder to expunge.

    That said, the level of stupid on display here(especially for a company that is supposed to know how to, say, sign and deploy device drivers; and run a website with a secure order form) is pretty terrifying. Bugs are bad; but at least some of them are subtle. Adding a trusted root cert with an easily extractable private key to a huge number of customer systems isn't a 'bug', it's insanity.

  8. Good God; Why? on Pearson Credential Manager System Used By Cisco, IBM, F5 Has Been Breached · · Score: 1

    Why would so many companies(some with actual software development experience; and others dangerously willing to try, like Adobe) put up with Pearson software?

    I realize that testing isn't a core competency and whatnot; but Pearson provides software; as written by people who shouldn't be allowed to write textbooks; but who are dangerously good at writing contracts. It couldn't possibly be worse if Adobe took a stab at writing a testing module based on some hideous combination of shockwave Xtras and Coldfusion. Hell, extending Lotus Notes to test people for specific credentials, as well as test their sanity, would produce a better result. Why? Why Pearson?

  9. Re:Speaking of recruitment... on How Anonymous' War With Isis Is Actually Harming Counter-Terrorism (metro.co.uk) · · Score: 1

    The 'not living in a vacuum' issue is sort of the whole point: my question is whether we lose more by having garden-variety not terribly dangerous losers 'radicalized' into more dangerous ones; or whether we gain more by having an outlet for people to make their intentions clear by running off to fight in Syria. This obviously isn't an ideal scenario; but given the difficulty we've had in distinguishing between the merely disgruntled and the actively dangerous; that sort of clarity has some value.

  10. Speaking of recruitment... on How Anonymous' War With Isis Is Actually Harming Counter-Terrorism (metro.co.uk) · · Score: 3, Interesting

    Aside from the intelligence advantages of having people who are comparatively difficult to infiltrate in person voluntarily post lots of stuff to online services almost entirely within western jurisdictions; I have to wonder how much of the freak-out about ISIS' Twitter Accounts!!! is reasonable, and how much of it is a petulant reaction from western military and intelligence officials who have no real experience with not enjoying substantial media cooperation and the ability to keep things 'on message' as they prefer.

    They certainly like to talk about 'radicalization' as though it is something that can insidiously corrupt anyone exposed to enemy propaganda, regardless of their prior circumstances; but what do we actually know about the impressionability of these 'radicalized' targets? Does it actually work on anyone; or primarily on people who were somewhere between deeply skeptical of, and overtly hostile to, 'the west' in the first place?

    In the same vein, given that there are nontrivial numbers of people who are anywhere between skeptical and hostile; are we actually worse off if the sinister terrorist propaganda incites them to leave and go join the glorious struggle in jihadistan? Yes, having more recruits available makes our attempt to pretend that Iraq isn't a total clusterfuck harder; but it also means that the people who most actively dislike us are no longer living next door and brooding; but off getting themselves killed, or enjoying their medieval theocracy.

    I'd certainly wan to avoid having people leave and then return; that is just asking for trouble; but are we actually worse off if the people who like us least have an exciting relocation option?

  11. Re:Apple Music on How Apple Is Giving Design a Bad Name (theverge.com) · · Score: 1

    I have no interest in defending Android's attempt at having a 'back' button, which is indeed riddled with inconsistency and confusion; but it seemed worth a mention because being able to say 'whatever I just did, undo it' is an important aspect of making a UI discoverable(especially when the screen size is such that the icons and labels don't have as much room to be descriptive); and it is an area where Apple went from doing it pretty well to not even bothering. Android is pretty lousy; but nobody writes articles about their declining standards; because that's just expected(and, given what Android used to look like, it's not clear that there was much room to get worse).

    As for right-click, it is true that Apple OSes have supported right click for quite some time; but that doesn't change the fact that Apple was by far the most aggressive in requiring that a single-button mouse be treated as a first-class use case, with additional mouse buttons or keypress and click combinations treated as optional alternatives. With the possible exception of some esoteric X11 window manager, I don't know of anything that required a multibutton mouse; but the default baseline in Windows was always two buttons; with alternatives to right-click often being pretty clunky; and sometimes nonexistent in 3rd party software.

  12. Re:I just can't see it. on Telemedicine: The State of Telepresence In Healthcare (robohub.org) · · Score: 1

    I think that the plan is to keep squeezing the humans, larger caseloads, less training, lower pay and status, until the quality of human-provided care is sufficiently grim that you'll accept the efficient neutrality of the robots as the lesser of two evils.

    The process certainly hasn't been completed; but there are some good examples to be found in areas of medicine that are(whether anyone is willing to say it in so many words or not) seen as largely futile cost centers: nursing homes seem to provide a lot of the good horror stories; lots of frail old people, aggressive cost cutting in staff/patient ratios and staff salary and qualifications, and then grandma isn't being checked often enough to keep ghastly bedsores away.

    It's not that 'telemedicine' doesn't have potential, or valid use cases, being able to consult with colleagues, even if you are out in the sticks, is obviously helpful; and there isn't much sense in having a country GP also doing his own labs, cultures, and x-ray film developing in the evening; but, as in other areas where automated interfaces are being pushed as a replacement for humans, cost cutting will end up being a major use; presumably by a mixture of directly replacing some jobs, where possible, and allowing others to be filled with cheaper, lower skill, people because now the expert systems and the remote specialists are handling the tricky questions.

  13. Re:Poison is bad for living things on Pesticides Turn Bumblebees Into Poor Pollinators (acs.org) · · Score: 1

    Some poisons are subtler than others; but ones that target the nervous system are good candidates for 'effects will be a pain in the ass to tease out; but probably start to show up at doses well below lethal'.

  14. Re:Translation : on Pesticides Turn Bumblebees Into Poor Pollinators (acs.org) · · Score: 4, Funny

    It seems reasonable enough to me that bees that quit pollinating multiple times a day to take a smoke break would be less efficient than normal, upstanding, hard working, bees.

  15. Re:Good article on How Apple Is Giving Design a Bad Name (theverge.com) · · Score: 1

    The nasty trick is that one can 'manage complexity' too hard, or incorrectly, and end up making things worse. Anyone who has ever tried to walk a confused user through the fact that a digital camera shows up as a filesystem containing images when plugged into a computer would certainly sympathize with iOS' "Let's just pretend that the filesystem doesn't exist at all; and itunes will handle all the synchronization' strategy; but more or less the moment the use case expanded beyond syncing music to your phone and pulling pictures from it; everyone got a hard reminder of how often we do actually go to a representation of the filesystem when creating, editing, combining, etc. documents of various sorts. So, instead of being filesystem-free, things went to 'well, maybe the app supports dropbox? Maybe Google Drive? Maybe iCloud will magic it? Email it to yourself?' limbo of the sort normally only experienced when trying to move documents between computers.

    If you want to make something automagic, the magic has to work; or the results will get ugly fast.

  16. Re:Not Sure on How Apple Is Giving Design a Bad Name (theverge.com) · · Score: 4, Insightful

    Apple's adventures in skeuomorphism were pretty awful(the 'stitched leather' iCal UI? 'Game Center' and its straight-from-vegas textures? the period where every goddamn UI element was made to look like brushed aluminum, despite the fact that neither CRTs nor LCDs can actually emulate the look of reflective metal very well? iBooks hideous woodgrain shelves?); but whoever ended up carrying out the purge seems to have forgotten that there is a difference between slavish visual copies of real objects and the visual cues necessary to make a conceptual model of a real object usable.

    A 'button', say, doesn't need to look like any particular physical button; but if it doesn't have some sort of border the 'a specific location that can be pressed to provide some sort of input' concept becomes a lot more confusing, because now you have to guess what the location is. You don't need to(and probably shouldn't) do some horrible bitmap clone of the buttons on your favorite 70s stereo; but you can only cut away so much before you lose the metaphor and end up with something that is neither an intuitive evocation of a real world item nor a new mode of interaction; but just sort of sucks.

  17. Re:Apple Music on How Apple Is Giving Design a Bad Name (theverge.com) · · Score: 2

    I think the complaint with Apple's UI trend is not so much based on the assert of the command prompt's superiority; but the fact that Apple used to build GUIs with the objective(usually fairly successful) of being trivially discoverable, relatively forgiving, and fairly aggressively non-modal.

    Now, for reasons that seem increasingly driven by a fetish for minimalism, their buttons are getting smaller and less intuitive, sometimes wholly invisible until you know what edge of the screen to swipe and in what direction, iOS has a 'drop everything and dump me back at the home screen' button; but a 'back' button is on a per app basis and only if the developer feels like it; and the company that used to hold the line on keeping right-click out of its interfaces now takes pride in the fact that 'touch', 'swipe', 'longer touch' and 'force touch' are all distinct things that may or may not have totally different effects.

    Inscrutability has its place, if it can reward experience with power; but if it is merely a reflection of unsystematic feature accretion and ill advised removal of unsightly but useful UI elements, you have a problem. That is what Apple seems to be dabbling in at this point.

  18. Re:Apple Music on How Apple Is Giving Design a Bad Name (theverge.com) · · Score: 1

    You aren't supposed to use it; you are supposed to bask in the splendor of what Apple saw fit to reveal to you.

  19. As in this case, where I think that the state were utter morons for having a 'no hats, unless you think god says so' rule, rather than a 'no hats, period' or 'yeah, hats, whatever' rule; I would be opposed to religion-based exemptions from uniform standards for animal slaughter.

    The reason I included that example was not personal agreement or disagreement; just that it is a case, unlike IDs, where state interest in animal welfare(especially when the animals aren't pets or lab animals) is really pretty new; and it is easier to find people who don't give a damn about weak animal welfare protections or documented violations of animal protections; but develop a sudden interest if they are specifically for the purposes of the other guy's freaky religion; rather than just efficiency and cost.

  20. Re:Brilliant idea on The War On Campus Sexual Assault Goes Digital · · Score: 1

    Now if we only found an effective, level-headed way to deal with the agressors: granted, the agression has to stop (better after two reports than never, but one feels even that is two reports too late). Granted, the agressors carry a responsability for their deeds. But starting an irrational witch hunt seems contraproductive (remember "...the children") -- the agressors need help too.

    It would certainly be nice(both for victimizations prevented and for people who don't need to be punished) if we found a way to reliably discourage people ahead of time; and prevent recidivism after the fact; but it's a bit much to say that 'aggressors need help too'.

    Last I checked, we have an ample supply of humans available, with no shortages expected. Prevention and rehabilitation may be morally desirable; but when you have access to ample spare parts; you can simply discard defective units rather than try to rework them.

  21. Re:Fact check or PC checking? on Texas Narrowly Rejects Allowing Academics To Fact-Check Public School Textbooks (csmonitor.com) · · Score: 2

    Arguably, it depends on context:

    If I said "Class, the 'Triangular Trade' is the term used to describe the trade route by which Caribbean sugar was shipped to the northern colonies, where it was turned into rum, and the rum shipped to west Africa, where it was traded for workers, who were needed to produce sugar in the Caribbean." it is hard to say, with a straight face, that I am being anything close to accurate: Yes, slaves do work, and people who work are workers, so quoth Merriam Webster; but it's clear that I'm omitting a rather important little detail about the whole arrangement; in a way that can only be described as cravenly dishonest.

    If I said: "So, this pie chart shows a breakdown of workers, by occupation, in South Carolina in 1850." I would still be combining enslaved and free laborers into the same pool; but the objective of my lesson would be 'how is the workforce structured?' which makes my elision of 'how is the workforce motivated?' less a lie-by-omission; though it would be a better lesson if I also showed "breakdown of slaves, by occupation, in South Carolina in 1850", and "free labor, by occupation" for comparison.

    That's the thing with natural language; many words are 'synonyms' in that at least one definition of word A is more or less the same as one definition of word B; but almost all words have enough distinct nuances to them that you can't get anything like transitivity or well-behaved equivalence relations without brutalizing the meaning of a text(which is kind of an amusing party game: start with a sentence and see who can most entertainingly distort it, exclusively by replacing words with ones that are allegedly 'synonyms'; but not helpful for information transfer).

    What I don't know, offhand, is the context used in this particular textbook.

  22. So, let me get this straight... on Terrorism Case Challenges FISA Spying (buzzfeed.com) · · Score: 4, Insightful

    The FBI clearly failed to comply with even the cursory procedural requirements imposed on their nigh-unlimited power; and this is a 'difficult puzzle'?

    How low can you go? I realize that terrorists are super scary and stuff; but if you can't comply with the onerous burdens of the FISA court, the one with 24/7 top-secret-clearance judges on call; and 'retroactive warrants', and similar user-friendly features; what exactly can you be trusted with? They wouldn't let someone that sloppy and/or dishonest operate a cash register.

    This case doesn't even have a "We need to strike a balance between security and civil liberties, guys!" angle: the FBI got everything they could possibly want; and just couldn't be bothered to follow the rules of evidence during the trial. It may well be that kiddo is a real hard case(or will be before this is over); but it would appear to be the FBI that needs some housecleaning.

  23. Re:Wait... on DoJ Going After Makers of Dietary Supplement (reuters.com) · · Score: 2

    It's actually not uncommon: The homeopathy guys are the ones who got to great lengths to avoid active ingredients; but the 'herbal supplements' industry learned some time ago that customer satisfaction is improved if the customer gets to bask in how 'natural' and 'wholistic' the remedy is(and skip tedious prescription paperwork); but it also actually does something useful because of 'impurities' that...coincidentally...tend to be dubiously sourced drugs that actually have the effect that the plant matter is supposed to have.

  24. Re:Regulation please on DoJ Going After Makers of Dietary Supplement (reuters.com) · · Score: 1

    Quirkly little story, actually. Aside from the usual 'regulators toothless, undermanned, scammers multiply and scurry like cockroaches' issue, which is the case generally; "supplements" are a weird little world of their own.

    For I-know-not-what cultural or historical reasons, Utah is ground zero for the American 'dietary supplement' industry(since many of these companies also use multilevel marketing arrangments; the joke is that 'MLM' stands for 'mormons losing money'). Senator Orrin Hatch obliged his hometown industry with the DSHEA, which theoretically limited FDA scrutiny of anything classified as a 'dietary supplement' to enforcement of sound manufacturing practices(in practice, resources are limited enough that most of the market evades even that level of scrutiny, which is why you get thinks like herbal supplements that don't even contain measurable levels of DNA from the species they are supposed to be made of; and 'natural' remedies that mysteriously contain 'contaminants' that happen to be dubiously sourced drugs that are actually known to have some effect in line with what the supplement is supposed to do.)

    If a supplement kills enough people outright (as with ephedra a number of years back) the FDA can get it pulled; but it's a reactive process. In practice, given the legal limits of what the FDA can do, at the even tighter practical limits, you see moves like this where the FTC, DoJ, or a state AG smacks one of the vendors down for egregiously fraudulent labeling that doesn't even accurately describe what is in the bottle. If you actually honestly label your product, you are an honest vendor by the standards of the trade, and have very little to worry about.

  25. Re:Hey guys, 1979 wants its technology back! on US Navy Is Planning To Launch a Squadron of Underwater Drones By 2020 (robohub.org) · · Score: 1

    I'd imagine that the low-budget/no-budget option would involve periodically surfacing to make radio contact and get a GPS fix, to correct for the limitations of dead reckoning and magnetic navigational instruments; and to receive amended orders. You'd have to balance the desire for fine-grained control versus the desire to make detection and attribution difficult, so you'd presumably want to provide the unit with as much of its mission before setting it loose as you can, with subsequent contact only as necessary.