Slashdot Mirror


User: fuzzyfuzzyfungus

fuzzyfuzzyfungus's activity in the archive.

Stories
0
Comments
15,204
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 15,204

  1. Re:Lenovo on Lenovo Installed Software On Laptops That Persisted After Complete Wipes · · Score: 4, Interesting

    On the plus side, the script kiddie might have a somewhat tricky time of it. On the minus side, if the OEM doesn't cave, or is actively hostile, you are also going to have a nasty time of it.

    Suitably recent Intel CPUs have 'Intel boot guard'(Just above the middle of page 4). Apparently, in practice, basically all the vendors ship in 'Verified boot' mode. Their public key is fused in to the silicon at the factory; and if the appropriate private key wasn't used to sign the firmware, no dice.

    The 'measured boot' capability is a bit more interesting; but largely moot because nobody uses it. I wouldn't put it past an OEM to somehow screw this up; but all reasonably contemporary laptops are not going to take kindly to 3rd party firmware.

  2. Re:Oh, this should be good... on Tech Firms, Retailers Propose Security and Privacy Rules For Internet of Things · · Score: 1

    There is also the aspect, which really doesn't help, that 'internet of things' isn't really 'internet of things' unless the things talk to one another in some useful way.

    There are more and less invasive implementations of this, of course; but if your internet of things isn't internetworking for some useful end, what's the point? Once you've done that, unless you are extremely elegant and careful(or it's a 100% in-house network), you've got something that a reasonably sophisticated attacker can draw all kinds of inferences about(just as the current internet is not exactly a hotbed of privacy, and things like TOR are deliberately 'bad' networking practice, in an efficiency sense, since that's the only way to avoid being really obvious and easy to draw inferences about. Team Marketing will make it worse; but they won't really have to work very hard.

  3. We don't mean to literally imply that consumers are crops; that would be silly. It's more of a metaphorical usage that captures our degree of respect for their moral personhood and preferred mode of economic relation with them. Please do not be alarmed, that would be a PR hassle.

  4. Re:RULE #1: kernels updates without entire reinsta on Tech Firms, Retailers Propose Security and Privacy Rules For Internet of Things · · Score: 1

    ARM is trying to crack down on that to some degree(mostly at the high end, in recent-design 64 bit devices designed to not be laughed out of the datacenter. Unfortunately, they decided that UEFI was clearly a good idea...

    As for the low end, the cost and minimal power budget are pretty attractive; but touching an ARM platform that lacks a robust community, a very competent BSP, or both, hurts. Sometimes a lot.

  5. Oh, this should be good... on Tech Firms, Retailers Propose Security and Privacy Rules For Internet of Things · · Score: 1

    FFS, even the abhuman shitweasels over in 'behavioral advertising' have a ponderously longwinded, self-important, and oh-so-virtuous set of 'best practices' that they allegedly use to self-regulate.

    Between the fact that these 'IoT' vendors have incentives dangerously similar to advertising and surveillance peddlers; and a track record for software quality that would make vendors of cheap crap routers cry; what possible reason for optimism is there?

  6. So what exactly is included? on Microsoft Releases Windows 10 IoT Core For Small, Embedded Devices · · Score: 1

    Given that WinCE has mostly gotten the chop(the sort of legacy customers that remain aren't the kind that you just cut off; but they aren't soliciting new ones); I assume that an NT kernel is included; but given that we are dealing with ARM devices that have a mostly fixed set of hardware included and largely custom add-ons, driver support or binary compatibility aren't going to be selling points.

    So, what do they include, and what is the pitch? Best environment for .net programmers looking to twiddle GPIOs? Something the kernel is radically faster at?

  7. Re: Good on U.K. Government Seeking To End Reliance On Oracle · · Score: 1

    Oracle is certainly legendarily evil; and quite good at it; but I have to imagine that the UK government has enough scattered and dysfunctional license purchases, and situations where people over-bought, that they at least have a very good chance of saving more money by re-negotiating from a position of better information than it will cost them to take a proper inventory of their licensing situation. I'm sceptical about any substantial number of Oracle products being swapped out, and more skeptical still about some sort of UK-funded OSS Oracle-killer project; but it is still a good idea to review your morass of licenses and contracts from time to time and attempt to get them restructured on the best terms you can. On a national level, this often involves an initial round of posturing about alternatives.

  8. Re: Good on U.K. Government Seeking To End Reliance On Oracle · · Score: 1

    The devil is(as always) in the details; but what you would really want to shoot for is format and API level openness and standardization. Unless a state wishes to make OSS a political priority(I do; but I might not be able to make my taxpayers do so); it is perfectly acceptable to pay a proprietary vendor to solve a proble if they can present a suitably compelling offer; but unless you are insulated from them by as much API, protocol, and format standardization as possible, you run the risk of being either shaken down because the cost to replace them is high and they price to reflect that; or left high and dry if they fold/discontinue the product/get aquired/etc. OSS can be a good solution(or, at very least, a valuable hedge against vendors getting too optimistic in negotiations); but it isn't the only way to retain flexibility, which is what you really want.

  9. Re: Obviously Yahoo minimizes it... on Hackers Exploit Adobe Flash Vulnerability In Yahoo Ads · · Score: 1

    I don't think that it's Yahoo-exclusive by any means; even in online-advertising trade rags you see a lot of complaining about the shadiness of the various marketplaces and middlemen who sell ad placement on web properties too small or numerous to be interacted with personally; and an only modestly smaller volume of complaints about even some of the big, relatively respectable, players.

    In fairness to the ad flacks(you won't hear me say that one often); they are facing a task that is about as difficult as some combination of anti-spam and antivirus; but with the added complication that they get paid per 'message' received, so there isn't even a good alignment of incentives, as there is with anti-spam. The malicious ad users will try anything to sneak their ads into the system; and probably to avoid paying for them to be run, if they can help it; the middlemen have an incentive to serve ads to bots and then charge for those 'impressions'; and testing an ad for malice, especially if it employs zero days or cleverly pulls in external payload, is basically the same impossible problem that AV is.

    I can't say that I'm too sorry for them; just because I loath the advertising industry so much; but I cannot fairly accuse them of failing at an easy problem(because it isn't an easy problem); merely state that they have failed so profoundly that my concern for my own security now outweighs any 'is it ethical or not' questions so heavily as to make them irrelevant. At least on TV and in print media, ads are safe, if annoying; but on the web they are among the most dangerous vectors anyone who isn't either a porn/warez enthusiast or important enough for targeted attacks is exposed to.

    Heck, in my capacity as 'IT' at work, I would turn down a user who wanted to see the ads, simply because the risk is too hgih.

  10. Re: dry ink on Epson Is Trying To Kill the Printer Ink Cartridge · · Score: 2

    I would be the first to agree that 'starter cartridges' are a dick move on any number of levels; but the e-waste issue is somewhat ameliorated by the fact that the 3rd party cartridge peddlers are keen enough to get nearly-new hardware that they can dump more toner into that they will generally pay you for them. It is routine for office supply stores and the like to offer cash or store credit for empty cartridges, so they get tossed less often than they otherwise would.

  11. Re: dry ink on Epson Is Trying To Kill the Printer Ink Cartridge · · Score: 1

    You must be lying. The 'decent HP inkjet' is shelved next to the square circle; and about as likely to be on stock.

  12. Obviously Yahoo minimizes it... on Hackers Exploit Adobe Flash Vulnerability In Yahoo Ads · · Score: 5, Insightful

    Aside from reflexive ass-covering, which is to be expected; Yahoo(and any of their ilk in the advertisement slinging business) have a fairly obvious incentive to deny the seriousness of the problem.

    Ad networks are a ghastly open sewer of shoddily vetted and frequently dangerous crap; usually served agonizingly slowly and heavy on Flash and scripts and crap. Even better, ads offer a nice way to hit a broad selection of users, across sites, and without needing to compromise specific operators or lure people into the seedy side of the internet where people stereotypically go to get unpleasant viruses.

    Even if you are one of the 'But advertising experiences enable the content economy, ad-blockers are immoral and killing businesses, etc.' people, what do you say about the sheer danger? Leaving ads unblocked is about as safe as letting sewage into your drinking water distribution system. That's a problem. Fix your ghastly excuse for a platform, so I could at least let my guard down without getting cyber-syphilis, and then maybe we can have a chat about whether ads are wonderful or not. Until that time, don't even bother.

  13. Re:Deny access on Cleaning Up Botnets Takes Years, May Never Be Completed · · Score: 1

    Denial arguably creates a problematic perverse incentive because it provides a DoS-like extra 'for free' if you can manage to make the target act enough like it has been botted.

    For people who aren't exactly up to the task of running their own IDS, though, information would certainly be helpful. There probably are people who don't care about running a festering worm farm; but there are definitely people who don't know that they are doing so.

  14. Re: society of fear on Unicode Consortium Looks At Symbols For Allergies · · Score: 1

    It is illogical; but these are well documented biases in human risk perception(individual and, alas, institutional): We fear risk more if we perceive ourselves as having no control over the situation(so, would rather risk a crash themselves than be at the mercy of even an expert other driver). We also fear risks imposed by other people more than those imposed by 'natural' or 'chance' causes, hence the fear of 'criminals' being greater than that of burning to death.

  15. Re: Food Allergies on Unicode Consortium Looks At Symbols For Allergies · · Score: 1

    Amphetamine Deficiency Disorder is a very real and tragically under treated condition. Do you think those poor bastards paying black market prices for God-knows-what crap cooked up in somebody's trailer would be doing so if they could just get a nice, cheap, legal bottle of pep pills at their local pharmacy?

  16. Re:some, at least, are already in widespread use on Unicode Consortium Looks At Symbols For Allergies · · Score: 1

    Unfortunately, the 'standardization' part is where this proposal seems most challenged(though, in principle it seems like a good idea). Section C-2) of the proposal form is:

    "2. Has contact been made to members of the user community (for example: National Body, user groups of the script or characters, other experts, etc.)? "

    The submitter answers 'No'. That's a problem. The Unicode Consortium standardizes the codepoint representation of glyphs across systems; but they have zero power(and aren't supposed to be the go-to) for designing or standardizing symbols, much less symbols that really need to be legally mandated to be useful(eg. all the 'gluten-free' as in 'we cater to fad diets' vs. 'gluten free' as in 'we maintain the same rigorous standards that a celiac disease patient's immune system does.' can be a nasty one).

    As long as the 'peanut' emoji can mean anything from 'processed on equipment also used to process peanuts' to 'yup, this is the pad thai with peanut chunks on top'; it just isn't much good. If even a regional body(US, EU, one of the BRICs, somebody) or a standards entity promulgated symbols(like the well standardized and often legally binding ones used for marking hazardous goods in shipping and transport); then hell yeah, give them Unicode representations. Until then, though, this is just a proposal to add pictures of food objects, a less-than-helpful and nigh unlimited project.

  17. Re:because Gamers are really Graphics Snobs on Modding Community Putting HD Textures Into Resident Evil 4 · · Score: 2

    "HD" is an unfortunate bullshit marketing term that should be taken out and beaten to death with the same shovel used to dig its shallow grave; but that doesn't change the fact that there are 'textures that look really atrocious on a contemporary high-ish resolution LCD; despite having looked OK in my memories of the game as played on by a CRT TV being fed a composite video signal'. And, because Capcom are just that lazy, Resident Evil 4 HD apparently has them.

    The fact that "HD" carefully avoids meaning anything specific, while vaguely suggesting better sensory experiences worth paying more for, is obnoxious; but that doesn't change the fact that time has not been kind to some games; and some of the sins that phosphor dots and analog video used to smear into a warm glow just turn into a swarm of razor-sharp jagged pixels and offend your eyes mercilessly on newer hardware. Low resolution textures are one of those sins, probably among the worst(low-poly models don't look very realistic; but they don't grate on you), and one that doesn't get fixed as often because redoing a big chunk of art assets is a lot of trouble.

  18. Shouldn't this work the other way? on Unicode Consortium Looks At Symbols For Allergies · · Score: 5, Insightful

    This doesn't seem like an intrinsically bad idea; things like the GHS hazard pictograms, DIN 4844-2, ISO 3864, TSCA marks, and similar such things seem like perfectly reasonable additions to Unicode(some of them are already there).

    What seems like more of a problem is the idea that the Unicode Consortium is out there fishing for ideas. A project of that scope has more than enough backlog to work through; what possible benefit could there be in putzing around internally with ideas for stuff that hasn't been codified by any relevant user groups, standards bodies, experts, national standards, etc? If they think that they have free time for that, they probably aren't looking hard enough at the stew of natural languages and commonly used symbols out there.

    The original round of unicode-ified emoji, while puerile and obnoxious, were at least a solid instance of one of the Consortium's functions: the symbols were in wide use; but saddled with a horrible mess of legacy encoding schemes and general awfulness, so the only thing to do was wade in, hand out code points, and hope that the legacy systems could be burned to the ground as soon as possible. Same reason why parts of Unicode have substantial amounts of duplication, single characters that should be represented as composites, and so on; because various legacy standards had to die.

    Here, though, there is no obvious existing standard being modeled on, nor any interoperability issue being solved. If somebody wants Unicode to have a picture of absolutely everything; maybe they should go work on graphics format standards.

  19. Umm, I hope that translation is to blame. on Google's Project Loon Balloons May Cover Sri Lanka With Internet Access · · Score: 1

    I really hope that "proud to declare that we are at the cusp of a reclaiming our heritage of being connected to each other and connected to the world." made a lot more sense before some translator mangled it; because otherwise it seems like absurd nonsense. If people were connected long enough and far enough back in time for it to count as 'heritage', the technology behind those connections must have been comparatively primitive. Is he saying that communications have regressed since that time? What golden age of connectedness is he talking about?

  20. Re:Marriage Partner on NY Judge Rules Research Chimps Are Not 'Legal Persons' · · Score: 2

    No, I'm pretty sure that corporate marriage is the old-school kind, where you get legally subsumed under the principle of coverture and become a wholly owned subsidiary

  21. Re:Marriage Partner on NY Judge Rules Research Chimps Are Not 'Legal Persons' · · Score: 2

    Well, getting screwed by corporations is pretty common; but I've never heard of anyone trying to marry one just because of its personhood...

  22. That's a good sign. on The New Google Glass Is All Business · · Score: 2

    I'm guessing that their decision to pitch rev. 2 at the 'people who propped up the blackberry holster market' demographic suggests that the Glass team was not entirely successful at coming up with a version that isn't socially alienating and ridiculous looking?

  23. Re:Why not both? on Sharp Announces Sales of DC Powered Air Conditioner, Other Products To Follow · · Score: 1

    I didn't make it suitably clear; but the 'complexity' is really more of a historical issue. The fact that you can get power transistors, digital logic, and similar solid-state goodness for peanuts, possibly even less than the carbon brushes or other electromechanical alternatives, is a comparatively recent thing in historical terms.

    Now that you can, doing so is pretty compelling for any but the highest-power tasks; but it has not always been the case that you can throw semiconductors at a problem for astonishingly tiny amounts of money. Today it is; but a lot of very clever electromechanical, inductive, and similar tricks were developed during the time that it was not.

  24. Re:Low cost chip, high cost support on Oracle To Debut Low-Cost SPARC Chip Next Month · · Score: 3, Interesting

    What I find a bit weird about SPARC's near-total obscurity is that(please correct me if I'm wrong on the details; but to the best of my understanding from what I've read) the ISA is available for use on a royalty-free basis, and there are even a few BSD or GPL verilog implementations out there. That's even less encumbered than MIPS(which has some patents that the owners like to wave around on a couple of useful instructions).

    My naive expectation would have been that SPARC on such liberal terms would show up a bit more often embedded in various chips that need some sort of CPU to do housekeeping, as the ISA of security and/or nationalism driven 'indigenous technology' efforts, and potentially even as the cheaper-than-ARM option for application processors.

    Clearly that hasn't actually happened, and it's mostly ARM in SoCs and application processors(with PPC holding out in certain automotive and networking niches for some reason; and MIPS in router SoCs and the occasional Chinese vanity project); so ARM's license fees must just not sting that much.

    Building SPARC parts that go toe to toe with Xeons would obviously be a much more ambitious project(as well as an act of directly fucking with Intel's juciest margins, which they probably won't take very kindly); but I am surprised by the fact that SPARC is so rare among the zillions of devices that have no need for x86 compatibility and are mostly about delivering performance in the gap between beefy microcontrollers and weak desktops for as little money as possible.

  25. Re:Disappointed on Sharp Announces Sales of DC Powered Air Conditioner, Other Products To Follow · · Score: 2

    The competition for good DC-DC conversion is reasonably fierce(given the existence of DC telco and datacenter operations, and the fact that even 'AC' shops are really just doing the conversion in each chassis(and unlike the old AT PSU days, an ever larger chunk of the output power is 12v going directly to a DC-DC converter on the motherboard to feed the CPU and RAM, with fewer and fewer components, aside from HDD motors, being sufficiently high voltage to feed directly from the PSU); so even modest improvements in DC-DC efficiency would make you quite wealthy indeed.

    I haven't kept a close eye; but I think that the present standard for DC-DC modules still uses a number of off-chip components(whether because the needed capacitance and such simply can't be done in silicon, or are cheaper as discretes, I don't know); but you can get some very, very, dense little modules.