Slashdot Mirror


User: Ironica

Ironica's activity in the archive.

Stories
0
Comments
1,953
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 1,953

  1. Re:Dont need to intsall on New IE Malware Captures Passwords Ahead Of SSL · · Score: 1

    Just download the zip file, and extract it - you should be able to run it in place from a directory!

    At my old job, I could *run* Mozilla just fine. I couldn't get the proxy config info I needed in order for it to get outside the company intranet, though.

    Also complain to your company security team about having to use an insecure browser.

    I worked in a 25-story building with several thousand other people, and we had about four deskside technicians for all of us. The "help desk" was about the most useless thing I've ever encountered... I had to badger them to even write down the problem I was having, so the tech would have some clue what he was coming for (and forget trying to solve problems over the phone). So security team? Hah.

  2. Re:It's probably fake: Blue Valley High on New IE Malware Captures Passwords Ahead Of SSL · · Score: 1


    Which demonstrate that a stupid guy (just dumb, not malicious) can very well become one of the spammers on a stupid mistake. (He actually typed in the wrong domain name, look here)

    This is the very reason why I think that posting these informations on a popular website such as slashdot should be punishable under the same laws as the spammers are.

    This guy (Theatetus (521747)) deserved to be punished. He has become one of them by his own stupidity.


    Um. Granted, he made many confusing typos all over the place, but if you follow what he said (and did your own WHOIS query on the info from the actual article, like I did) you'll find that the reg info he posted is in fact the reg info for the domain cited in the original write-up.

    Whether or not the info used to register the site is bogus... that's another story. But that registrant info is connected to the domain actually forwarded to by the malware.

    So can we have a new mod... -1, Jumping to Conclusions?

  3. Re:grr.. typo above on New IE Malware Captures Passwords Ahead Of SSL · · Score: 1

    So you're basically saying all these people send mail and call that guy for nothing? Way to go man. You just became one of them.

    No, he's saying that the domain name is typo'd in his post, but that he did the query on the correct domain from the article.

    The correct domain name (copied and pasted from the article) is:

    refestltd.com

    And is registered to Jay Seaton.

    The other domain name he typed doesn't exist. Nor do many other versions of it. It took me a while to figure out which was the right one, but the above name is the only permutation that actually is registered.

  4. Re:Because it isn't so clear cut on New IE Malware Captures Passwords Ahead Of SSL · · Score: 4, Interesting

    For the non-power user IE *IS* preferable.

    The non-power user is most vulnerable to the security flaws IE is famous for. They are less likely to notice if something is downloaded to them without consent, and less likely to be able to fix it if it is.

    I came to this conclusion after trying several times to get friends and family to migrate to Firefox from Explorer. Even when I did all the grunt work, installing and setting up the browser and explained the benefits to them, they all went back to IE.

    There's two things I tell/show people about Mozilla when I install it (waiting for 1.0 to start giving out Firefox):

    - Look, tabbed browsing. [perform Google search on something they find interesting. Middle-click on a lot of links.] Shiny!

    - Look, no pop-ups. This is the big winner.

    Oh, yeah, it's more secure, yadda yadda... but those are the two functions that the average person is going to find most beneficial. They may not pick up tabbed browsing, but they sure will appreciate built-in by-default popup blocking.

    It may take some persistence. Every time they call you for help, walk them through like they're using Mozilla. If they're not using Mozilla, tell them to use it instead.

    IE has enough features for them to deal with. They don't need the fancy "bells and whistles" of Mozilla, in fact they didn't even use the extra features. IE has the Microsoft look and feel they are used to. It's free, it's preinstalled, so they get used to the feel of it from the outset and don't have to download and install, a task many find daunting. And as most of the extra functionality Firefox has over IE comes from extensions, which they can't even work out anyway, then it seems pointless for me to try to force them to use it.

    My mom called me last week, when my phone battery was almost dead. Thankfully, it was a short conversation, because it went like this:

    "I heard that there's this new web exploit that MS doesn't have a patch for, but it's ok if you update your antivirus. So if I just update Norton I'll be fine?"

    "Are you using IE?"

    "No."

    "Go ahead and update Norton anyway, but you can only get the virus if you're using IE. Keep using Mozilla and you'll be fine."

    [bee-oop, bee-oop, bee-oop, phone goes dead]

    The last few months of retraining her to think of Mozilla as her default browser have paid off. Yay!

    For the average user, using Mozilla is like using a 4x4 to go shopping. It is needed one time in a million, and the rest of the time it is woefully underused.

    You could say the same about IE. Most of the security flaws come from having built-in functionality that is only useful in some very esoteric intranet environments, and has no business on the public web. The whole "Trusted Sites," "Internet Zone," etc. thing is WAY more complicated than it should be, and defaults to settings that aren't safe, so you do have to go in there and change things if you want a somewhat secure browsing experience.

    In Mozilla, the preferences are very clearly organized, with only a few things on any one screen. Makes it far easier for me to walk someone through changing something, and easier for the novice to find it themselves. The explanations are a lot more useful, too.

    To go with the car analogy, using IE is like using the company fleet's Ford Taurus with no right-hand wing mirror or air bags, because it's closer at hand than your Honda Civic Hybrid. In my opinion, anyway.

  5. Re:Because... on New IE Malware Captures Passwords Ahead Of SSL · · Score: 1

    Hello!!! Tell them hackers can steal money from their bank account if they use IE. If they still use it, pull a Pilate.

    After spending some quality time retraining my mom to use Mozilla instead of IE, it was with great satisfaction that I answered her concern about the last web bug going around.

    "Are you using IE?"
    "No."
    "Then you can't get the virus. Just keep using Mozilla, you're fine."

    She was happy to hear it too ;-)

  6. Re:one word on New IE Malware Captures Passwords Ahead Of SSL · · Score: 1

    It's also a matter of just making it easier for them to use Mozilla.

    I did this with my mom. After installing Mozilla on her computer, and telling her to use that as her main browser, any time she had a problem online I assumed she was using Mozilla and started supporting her that way. If she wasn't using it, that would quickly become apparent (because she's not able to find the menu/button/etc. I'm talking about) and so I say "Ok, then try it with Mozilla and see if it works." Usually, it does.

    It took a few months, but she usually uses it now. Sometimes she gets stuck in the AOL browser, if she clicks a link from an AOL email, but she's up for switching completely off of AOL once I get over there and figure out how to import her addresses and stuff.

  7. Re:Coming events on New IE Malware Captures Passwords Ahead Of SSL · · Score: 5, Insightful

    Yeah, but the only site still forcing me to use IE is my local bank...

    1) Complain, if you haven't already... some web commerce site (can't remember which, but it was a big one) had a bug where it didn't recognize Mozilla as a sufficiently high version of Netscape. I feedbacked it, they responded with a NON-CANNED thank you within 24 hours, and it was fixed by the time I used the site again three days later.

    2) Have you tried fooling the site by sending different authentication? Mozilla can just *tell* the site it's IE. Unless they're doing something very stupid like using ActiveX, that may work just fine. (If they are using ActiveX, switch banks. Seriously.)

  8. Re:CERT? CERT?? Isn't That An Antacid Tablet? on Telus Puts A Stop To 'Modem Hijacking' · · Score: 2, Funny

    Say "CERT" to someone and they'll assume you're talking about an antacid tablet.

    I can't stand the rampant ignorance about common pallatives! Certs are breath mints, not antacids, you ignoramus!

    I swear, people just don't even pay attention in the supermarket anymore. When will we have a serious effort to educate people about the proper uses of common products? This is how children end up in the hospital from Tums overdoses.... ;-)

  9. Re:Nice Idea? on Telus Puts A Stop To 'Modem Hijacking' · · Score: 1

    It seems to me a dialog box generated by the OS when an application tries to access the serial port would go a long way towards preventing this.

    Let's see...

    "The OS" is Windows. So they'd only put this in new versions, and you'd have to upgrade to get it. Then they'd have it disabled by default to begin with, since it could confuse people. Then in a service pack, they'd do a security rewrite, and have it enabled by default. But people would find it annoying that they have to click every time they go online, so they'd disable it anyway.

    So, no, it wouldn't go a very long way towards preventing this. Also, it probably would be fairly easy to circumvent in software. You'd need a hardware solution, and that would be even *more* cumbersome for people to deal with, so they'd be even less likely to use it.

  10. Re:It's amazing they're doing this... on Telus Puts A Stop To 'Modem Hijacking' · · Score: 1

    Exactly what crime are these people guilty of, anyway? If they tell their victims that they are going to be connected to an "international number" it's hardly fraud, even if that's exactly the intent.

    You're right... if they did tell them, it wouldn't be fraud.

    They don't.

    You download the software, which a website says you need in order to view particular content or whatever, and it disconnects you from your ISP and dials another number instead. That number is a long-distance number which charges you lots of money. You may notice your modem disconnecting and redialing, but it doesn't have to tell you what number it's calling.

    The malware can also just make the calls in the middle of the night, when you're not using the computer. Then you *really* don't know the call has been placed.

  11. Re:It's amazing they're doing this... on Telus Puts A Stop To 'Modem Hijacking' · · Score: 1

    For one, do you really think they were giving people refunds for these charges? Maybe Canada has some consumer protection laws or something, but from my dealings with scummy utility companies in the US, I know I'd pay every penny for a hijacked modem.

    Even if they're not refunding charges on these calls, they're paying CSRs to take the complaint calls generated by the problem. They may also have competition from VOIP and cable-based phone service, which could cause them to lose customers altogether.

  12. Re:This is good on Telus Puts A Stop To 'Modem Hijacking' · · Score: 1

    If you have a working modem in a linux box and someone out of boredom writes a C program that dials 1900-rand-prn. You'd be just as vulnerable is you left the line in.

    You forgot the step where they get the program onto your computer...

  13. Re:This is good on Telus Puts A Stop To 'Modem Hijacking' · · Score: 1

    I mean, I know the whole 'practice safe computing' line. I do so, myself. I won't run crap binaries, I won't visit shady websites.
    ...
    Like it or not, there are unpatched holes in IE and compromised webservers make a great infection vector.


    Part of practicing safe computing is configuring IE so that it won't do anything at any site you haven't specifically allowed (like windowsupdate.com or housecall.trendmicro.com). If you browse the web with IE, you are just not practicing safe computing. Sad but true.

  14. Re:And in the end, the reporter was an ass on Mind Scans to Map Decision Making Mechanics · · Score: 1

    "I reasoned that a man would have been just as competitive as I am, and guessed that I was going to betray him on the ninth round--so he would have kept all $30 to himself on the eighth round. At least, most of the ones I know would have, although maybe a sample consisting mostly of journalists isn't entirely representative."

    These tests would be an excellent way to see the norms inside each profession.


    And, in fact, in one article I read about game theory experiments, they pointed out that none of the subject groups behaved as the economists predicted... except the, er, economics students. ;-)

  15. Re:Trust? on Mind Scans to Map Decision Making Mechanics · · Score: 2, Insightful

    No, it would be used to get people to "trust" a corp. or Government, so that they buy more shit or follow mindlessly the politicians. Because, only the corps or gov'ts would have the money to afford such a procedure.

    You sure don't seem to have a lot of trust in the system... ;-)

    But actually, increasing the level of trust between actors (using the economic terminology here) would solve a lot of prisoner's dilemma type issues. A lot of our dysfunctional systems are that way simply because people do not trust others to participate honestly. Therefore, they have no individual motivation to participate honestly. How many people who cheat on their taxes justify it by saying "but *everyone* cheats on their taxes?" We would all be better off if everyone played fair, but instead, the honest people subsidize the dishonest, which over time brings more dishonesty into the system (this is a basic finding of many game-theory experiments, such as the Investment Game described in the article).

  16. Re:Perils of an incomplete model on Mind Scans to Map Decision Making Mechanics · · Score: 1

    That use of the term "irrational" comes from economists, who started using it before it even dawned on them that social and other psychological rewards and concerns may be valuable as well. And many economists haven't figured it out to this day.

    It's like the old joke about the drunk searching for his keys under the streetlight.

    Cop comes along, ask what's up, guy says, "Oh, I dropped my keys down the block, and I'm looking for them."

    Cop asks, "But if you dropped your keys somewhere else, why are you looking for them here?"

    Drunk answers, "The light's better here!"

    Monetary rewards are very well-illuminated. The other stuff is murky and hard to pin down. Therefore, it's easier to look for the answers where the light's better.

  17. Re:what advertisers won't do on Mind Scans to Map Decision Making Mechanics · · Score: 1

    Excellent post. Let me add one more point:

    I am just finishing up a Master's program in Transportation Planning. What surprised me about the program was how often we kept coming back to the study of economics in approaching transportation problems. Understanding how people make decisions is key to *changing* the decisions they make. Without knowing why someone will drive by themselves, even though they know that they'll save money by taking transit or time by carpooling, you cannot hope to increase vehicle occupancy and decrease congestion.

    It is particularly with provision of large-scale public goods, especially those with large externality problems, that research like this can really help. We *can't* do test marketing very effectively on transportation solutions, because you can't spend a billion dollars on building one lane of a new highway just to see if people like it or not. Taxpayers would be incensed if you spent hundreds of millions on switching out an entire bus fleet to see if the new buses were more popular. And in studies where they have compared people's responses on surveys with their actual behavior, we've found that people's reported transportation preferences often differ from their actual choices.

    Sure, marketing will benefit from better understanding of decision-making behavior, but areas that are *not* able to use traditional market research methods will benefit even more.

  18. Re:Insufficient juice on Mind Scans to Map Decision Making Mechanics · · Score: 1

    Disclaimer: I am only writing this because I am thirsty and like thinking about juice.

    And thus, the corrollary: there is no quantity of thirst significant enough to pull a geek away from /. (Or at least, kahei has not yet reached that quantity.)

  19. Re:Drugs on Mind Scans to Map Decision Making Mechanics · · Score: 1

    Which is why I think that certain types of drugs should be prohibited by law to the general population.

    Great idea! Gee, why hasn't anyone tried that?

  20. Re:Humans aren't so different at all on Mind Scans to Map Decision Making Mechanics · · Score: 1

    And I called bullshit on that. Talk to any number of women who care to discuss it. Many sure as hell know, based on the fact that they have marked changes in both physiology and increased sex drive. And yes, that's ovulation and hence fertility they're aware of, not only menstruation.

    Maybe I know when I'm ovulating, maybe I don't (consciously). But I don't *change color* or anything when I do. Most primate species, however, do have outwardly visible biological changes during estrus.

    Both of which point to an apparent flaw in your key assertion that: "human females, almost uniquely among animals, conceal when they're fertile." Hint: When they're pouncing on you, they're more likely fertile. Or drunk. Or both. :-)

    Or horny. Or think you have money. Or bored. Or... fact is, you *cannot tell* why she's pouncing on you. Fertility is one of several possible causes. Ovulation makes it more likely that she will pounce, but it does not correlate to a degree that pouncing on you can be considered a display of estrus.

    If women *only* wore high heels and makeup when they were ovulating, you'd have a point, but this is far from the case. Therefore, regardless of whether human women behave differently (to a statistically significant, but undetectable to the casual observer, level) during ovulation, they do not display their fertility status. Compared to other species, it seems appropriate to say this is concealment.

  21. Re:Humans are lucky... on Mind Scans to Map Decision Making Mechanics · · Score: 1

    Great post, but...

    Until the beginnings of agriculture (until recently thought to be about 10,00 years ago, recently pushed back to about 23,000 years ago), natural fertility suppression caused by breast-feeding and, if that failed, infanticide, suppressed additional offspring.

    Actually, before agriculture, women generally were *not* fertile year-round. Women have to be at a certain percentage body fat to build up the uterine lining, and ranging an average of 10 miles a day to find enough food to sustain life often dropped them below that level. It wasn't until the advent of subsistence agriculture that women started having monthly cycles year-round. So in the hunter-gatherer era, women simply couldn't get pregnant nearly as often. (Today, we see this happen in female athletes, such as marathon runners.)

  22. Re:My dad built original Dland fireworks computer on Disney Launches Fireworks With Compressed Air · · Score: 1

    Completed the transition of all of Disneyland's audio and attraction control tapes to solid-state ROMs for playback. They used to have rooms FULL of huge tape bins with 1" wide magtapes that would spool into a big 1" x 40" x 20" bins and be one big long lopp track - literally. This took a long time becuase back in the early 90's when they did it, they needed to send out the tapes to special subcontractors that could digitize it.

    I, and every other Tiki Room fan in the universe, THANK your dad from the bottom of our hearts for this.

    I went to D'land sometime in the late '80's with my mom, and the soundtrack for the Tiki Room was so scratched and beat up it was almost unbearable... we were both very disappointed (it was her favorite even before I was born, and I was absolutely fascinated with it as a girl). Early '90's sounds about right for when they fixed it.

  23. Re:Colors in smoke... on Disney Launches Fireworks With Compressed Air · · Score: 2, Insightful

    One of the things I love about fireworks is the light that's reflected in the smoke.
    The cloud that's created from launch turns into the color of the current firework going off. It just adds to the experience.


    Personally, I've never seen a professional fireworks show where I could see any of the smoke from the *launch*... just the smoke from the explosion in the air.

    Perhaps that's the smoke you're waxing rhapsodic about?

  24. Re:Kinda ruins the fun. on Disney Launches Fireworks With Compressed Air · · Score: 1

    Fireworks with no gunpowder smell? With no black snow falling? I have so many memories of watching the fireworks over the lake in Epcot, the clouds of smoke only visible when the fireworks explode and light up the sky.

    Hm, you just gave me some insight into why they did this...

    One of the biggest logistical problems with Fantasmic (the lake show at the original Disneyland) is that the actors have to run around a pitch-black Tom Sawyer's Island, changing clothes as they go, through a whole lot of fireworks smoke.

    At least now they'll just be running around a pitch-black Tom Sawyer's Island, changing clothes, without choking on smoke at the same time.

    (There will still be plenty of smoke when the bombs burst in the air. Don't fret; Disney would *never* remove a vital part of an entertainment experience! [Shut up, Ariel. Be happy with your happy ending.])

  25. Re:Better security is not a myth. on CERT Recommends Mozilla, Firefox · · Score: 1

    SATA drives are NOT supported by Windows XP. My brand-spanking-new Seagate 120 GB SATA drive would not work without loading Seagate's drivers during the install. XP does not have drivers for it.

    This is also true for Windows 2000.

    On the other hand, Windows 98se installs just fine on an SATA drive connected to an Asus A7N8X Deluxe with no driver mumbo-jumbo... but you can't even *upgrade* to Windows 2000 from there without loading the drivers. No idea what that's all about.