Slashdot Mirror


User: kd5biv

kd5biv's activity in the archive.

Stories
0
Comments
149
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 149

  1. Why use Outlook anyway? on Is The Microsoft-Free Office Possible? · · Score: 1

    If you want a small, fast, reasonably safe email client, try Eudora Light .. comes in WinXX/Mac versions, doesn't do any of this mysterious sh** behind the scenes (straight clean RFC822 SMTP/POP3 with normal MIME encoding), will talk to ANY normal mail server, works beautifully with most, and tells you what the fsck it's doing when it does it. No, I don't work for them, I just use their products.

    Eudora Pro is a bit annoying, but Light is just enough functionality for me without all the bloat, and it *doesn't* automatically run foreign executables. Shoot, it doesn't run them, period, until it's made sure I know the risks and trust the sender ..

  2. Re:Legality of fighting back on CNN Asks "Can You Hack Back?" · · Score: 1
    Anywho, apperently, in Canada, portscans and the type are not illegal. It isn't even illegal to *attempt* to break in... you haven't broken the law until you actually access the machine. The RCMP officer type I spoke with (who was quite accustomed to Linux - I was impressed) likened it to Girl Guides knocking on your door, which isn't illegal..
    Knocking on your door isn't illegal, but that's the equivalent of an ordinary ping or telnet to port 23. Port scanning is more like an organized team of Girl Guides armed with lockpicks and crowbars trying every window and door in your house to see if they can open them. That, in the USA, may not exactly be illegal, but it's darned suspicious, and if the police catch them doing it, they will end up being 'questioned' for 24-48 hours.

    Ask anyone who has to deal with this .. if you're being scanned, you can reasonably expect it to be someone probing for an attack. Do they have the right to sniff around looking for soft spots until they find your unpatched IMAP port, or do you have the right to blackhole them at the firewall when you see them sending syn's to a whole bunch of unmonitored ports?

    IM(NSF)HO, there are ports which can be viewed as 'public' -- Telnet, FTP, HTTP, SMTP, and POP, etc. -- and there are others that foreign users have no business playing around with, and the ones that play around with the odd ones, especially ones associated with known security holes, are at about the 99% confidence level of being up to no good. May not be right to DoS them in return, but if the Girl Guides were out casing your house, wouldn't you be withing your rights to chase them away? Same goes for overly inquisitive crackers ..
  3. Practically speaking .. on CNN Asks "Can You Hack Back?" · · Score: 2

    Another poster made the comment that the whole point of security is to make the cracker go away.

    Tactically, one could say a retaliatory crack against the offender *might* serve as a deterrent. It might also invite further attacks that otherwise would not have happened if the attacker had not been provoked by an intrusion into *his* territory (and don't forget crackers are very territorial creatures..) and the whole episode can easily escalate out of control. Strategically, you have to take the larger situation into account and move into the psychological realm. Since you want to discourage people from playing games with your system, the best response is probably something that takes the fun out of it by denying them the satisfaction of a response. IP/subnet blocking is a good example of this -- they can poke at your host all night long and not have any noticeable effect. A strategy that ties in well with this approach is one I like to call the 'threshold effect' -- anyone below a certain nuisance threshold is ignored, and once they become disruptive enough to be worth going after, they have enough of an attack signature to be traceable. Track them down and identify them first, before they know they've triggered the alarms, then let them know you know exactly who they are and what they're up to and would they please cut it the fsck out?, then go to the cops (net, local, or federal as the case may be) if nothing else works. Depending on how much sense they have, one or the other of these measures is likely to encourage them to play nice .. Needless to say, a) being sensitive to being port/IP scanned and b) making sure your hosts don't respond to any ports you don't run services for will help too ..

  4. Non-trivial task .. on Do-It-Yourself Sue Napster Software · · Score: 2
    I guess the problem with all this is that a file named Metallica isn't necessary a Metallica song. If the software downloaded the data and actually checked it, I'd feel better about it.
    All questions of the silliness of naming a file one thing when it's something else aside, were you seriously suggesting writing software that can detect songs recorded by Metallica from content alone? If so, I'll let you tackle that project. Hint: it's nontrivial, and will probably be very CPU intensive.

    But seriously folks, it's possible you could CRC the encoded sound data and scan for files matching that CRC. Not that it wouldn't generate more than a few false positives, even with a 32-bit CRC, or be very easily defeated by looping the song out to analog and re-encoding it back to MP3, producing a virtually identical-sounding file with a totally different signature ..

    Oh, and where will all the extra bandwidth to cover all these bot downloads come from? Just curious ..
  5. Re:Satellite probably best bet on Internet Access While Sailing? · · Score: 1
    2. SSB radio, but I've never heard of anyone running digital comms over it. And it depends on weather conditions how far it goes. But, it's nice to be able to hear real live crackly voices 1000 miles from land...
    HF digital is possible, but *slow* (limited to 300 bps!) .. IP over HF has been done, but don't count on it for anything but email. Check out Clover-II protocol if you're really interested ..
  6. Scary thought indeed. on Melbourne Trial Aborted Due To Crime Web Site · · Score: 1
    Beyond that, the article raises a lot of intersting AND frightening point. What if an offender has the same name as *you*? Shit, I know there was another guy with the same name AND same age as I in my university, although I never met him -- I discovered that when I applied for a library card: "oh you are already registered". Not me!
    If they don't know the suspect's name, but have a description that could fit you, or the name and description could both fit you, it's likely to come up if you happen to be (or could have been) in the neighborhood when the crime was committed.

    One reason I try to avoid getting ticketed these days -- that's when you're most likely to be flagged as someone they want to bring in and question, and bear in mind that in the USA at least, they can hold you for up to 48 hours (?) without any charges.

    This is also a reason I regularly monitor police dispatch frequencies .. at least if you're listening, you have some idea of what they think you might have done, although if it's serious they might try and confiscate your scanner .. and it doesn't hurt to keep an ear out for your license plate number in case something obviously bogus gets reported back.

    (Case in point: an LAPD officer in West Hollywood, I believe, sees a driver acting 'suspicious' and calls in the car's plate number. Dispatch reports the plate number as being registered to a completely different make and model. Cop says 'Right!!' and stops the car, calls backup, and they do the whole high-incident stolen-car get-out-with-your-hands-up-and-lie-down-on-the-pav ement routine with guns drawn, PA speaker, hostile witnesses, the whole bit. Dispatch comes back and says 'oops, that was supposed to be..' and gives the correct registration which matches the car and the driver, who has no priors and everybody in the car is clean. Paranoid and scared as hell, but clean. Cop gives a fairly lame apology and excuse and sends the car on its way. Could have been **MUCH, MUCH** worse, and this happened **WITH A TV CREW FILMING THE WHOLE THING**, so if anything they were being extra careful. Imagine what might have happened if one of the people in *that* car matched the description of a suspect in a rape case, or a recent convenience store robbery.)

    Yeah .. keeps me awake sometimes ..
  7. Didn't say it was a *good* idea, just interesting. on Ham Radio Repeater On The Moon? · · Score: 1
    Ham repeaters on the moon have been proposed since before Apollo, and I have always thought they were a bad idea [...]
    As a LEO fan myself (and someone who is anxiously waiting for Phase 3D to get to orbit even if it isn't LEO), I have to say the project probably won't happen. It's a big deal getting a package that size landed safely on the surface, even bigger getting it to survive long, and the proposal seems to be short a few critical clues.

    I just like the thought of making EME sideband contacts with something less than a kilowatt of PEP and an antenna stack that won't fit in my back yard ..

    Oh, BTW, once you post your callsign you're not anonymous anymore. ;-) 73 de KD5BIV/AE
  8. Re:Just in case anyone thinks this is real... on Potato-Powered Web Server · · Score: 1
    Potato, lemon and other vegetable-electrolyte electrochemical cells are, even with big electrodes, only good for a few milliamps per cell. With the nail-sized electrodes shown here, one Cu/Zn electrode pair per spud, and six or seven spuds, they could manage 0.8V (barely) per cell, and 1mA on a very very good day indeed. Probably much less - "high-current" spud cells do it, I think, with many pairs of electrodes in close proximity.
    Or thin sheet electrodes rather than round rods -- more surface area. But the proximity part is definitely right on the nail .. take a close look if you ever get to see the inside of a car battery .. big FLAT plates crammed in cheek by jowl, alternating lead and lead peroxide, and so close together they almost touch. (They do sometimes when the plates warp, which is why old batteries sometimes blow up when you crank the engine..)

    To translate to the potato world, that means large pieces of sheet copper and zinc, maybe with an insulating spacer, pressed into the potato like a potato-chip slicer, or alternately, thin slices of potato laid between the alternating copper and zinc sheets, which could be arranged to give you either a parallel stack (high current) or a series stack (high voltage) a la Signore Volta. Once you go to that much trouble, though, is it worth calling it a potato battery anymore? The copper gets pretty expensive, and maybe blotter paper soaked in vinegar would make better electrolyte..

    Or you could just go out and buy some NiMH cells and call it a day ..
  9. Nice try .. on Potato-Powered Web Server · · Score: 1

    .. but you can't share one electrolyte for five cells. Think about it: connecting the positive rod from the first one to the negative rod from the next one is effectively shorting out another "cell" in between them, thus cancelling out your voltage gain, drawing a fairly large current across the jumper, and blowing your efficiency all to hell.

    Now, if you *sliced* the potato, with insulating separators in between the slices (Saran Wrap, anyone?) *that* would let you turn your spud into a higher voltage battery .. stack up the slices with the separators and duct tape the whole thing together. Red Green would love it. ;-)

  10. My $.02 on H.R. 3113: Spam Bounty Hunters Wanted · · Score: 1

    Spam is only going to get worse. As more people realize that they can force millions of people to see at least the subject line of an unsolicited email (get rich quick, hot babes, get your own spam CD, take your pick) the problem will continue to escalate until email becomes a recipient supported ad delivery system.

    When it gets to that point, what will most users do? Realize they're throwing money down the drain for an ISP account that is so crammed with useless junk it's unusable for communicating with people they want to talk to.

    I don't like the idea of vigilante justice. It shouldn't be necessary to dangle re-ward money under people's noses just to get them to do what we should all be doing anyway -- capturing the messages and forwarding them to abuse@spammers_domain.com and/or abuse@higher_up_the_food_chain.net until someone is willing to take action. But, since most people outside the tech world are a lot more self-centered and need this kind of incentive to get them off their butts, this is what it usually takes to get enough people motivated to make a difference. Maybe it will work too well, and maybe for the wrong reasons, and maybe it's just a kludgy psychological hack, but it will get more people involved in keeping our email systems usable.

    And for the record, anyone who spams me is toast. I know who you are, and I know how to find out what I need to know to get you shut down. Consider this my opting out.

  11. Re:I can see it now... on H.R. 3113: Spam Bounty Hunters Wanted · · Score: 1
    Even the most inept telephone telemarketer has a few stories of conversions: people who start off following the "Put me on your No-Call list" script of DMA-supported so-called 'consumer' groups, but end up as buyers. The secret is that the longer you talk, the more likely you are to buy. Most people who follow a No-Call script would have hung up point-blank before. The 'don't call' script offers a tiny foot in the door of otherwise definite no-gos. The Telemarketers have scripts of their own to capitalize on this.
    I've used the do-not-call script on a few cold callers myself, and it's really funny to hear them bracing for what they know is coming and frantically switching scripts to get their pitch in before the call is over.

    The most pleasant effect is that all of a sudden they become very polite once you have their business name, address, and phone number. They know they can only talk to you for the remainder of the call and then they lose you for a whole year, so the remainder of the call is usually *very* professional.

    Or they hang up after your first question and you *know* you're dealing with a scam artist ..

    My point? It's not that much of a hassle to do this the legal way, and if the people in charge of writing this law have any sense, it won't be any more of a hassle to dismiss with a spammer. Plus, you do have the incentive of an occasional payoff *and* sticking it to a scammer once in a while. Unless they really screw this one up, I think the benefits are worth the drawbacks.
  12. Borland's old tricks .. on Borland C++ Can No Longer Be Used To Make Free Software? · · Score: 1

    Well, if it's anything like my venerable old copy of Turbo Pascal, the compiler puts the libraries into the compiled code in blocks .. the later version I have allows you to select which blocks of libraries you want in the build, but it still crams a lot of Borland code in there. I do remember disassembling the results one time and finding a copyright notice from Borland hidden in the binary ..

    My guess is that to get around this, you'd probably have to write your own compiler and compile it with Borland C++ to get to where you could write GPL-safe code. No, there's no way in **** they can stop you from distributing source, but they can sure hassle you about bundling their libraries with your binaries. They've never hassled me about it, but I'm sure if I distributed something popular enough, they'd come after me for a piece of it.

    Of course, this also doesn't stop you from developing the code on their C++ to speed up the edit-compile-run-crash cycle with their tools, then port it to a clean compiler once it works ..

  13. Re:Microsoft Development Process on Microsoft Develops Security-Path for Outlook · · Score: 1
    For every sensible sentence, you lose at least three calls to your $200-per-incident tech support line. Users love calling tech support, especially when there are fifty touch tone menus that all lead to the same two people.
    People actually thought this was a joke? ;-)

    Add to that the number of users who don't listen to the touch-tone options (I suspect some of them just press buttons at random until a human answers) and end up in a completely different group that doesn't have a clue how to handle their support. I'm sure this sounds familiar to some ..
  14. Re:Nuclear Explosion in a Vacuum on U.S. Had Plan To Nuke The Moon · · Score: 1

    Interesting description of the mechanics. Watch some of the archival film footage of the Castle Bravo shot (21MT? anyway, largest US atmospheric test and about 2.5x the yield they expected..) at Eniwetok Atoll. Very bright flash immediately followed by a darkening nitrogen oxide shell around the fireball, only getting bright again when it got to several miles across.

    I think the most fascinating thing about watching the footage of those early H-bomb shots was the dramatic local effects on clouds -- Ivy Mike was one example ..

  15. Re:At least they didn't plan to blow it up on U.S. Had Plan To Nuke The Moon · · Score: 1
    Since the moon is moving farher away from the earth all the time (due to friction from the tide) there are even people who think about stealing a moon from one of the other planets when it gets too far away.
    Which one? None of the ones nearby are anywhere near big enough .. Ceres probably isn't big enough either, and almost certainly isn't solid enough to last long that close to Earth. You'd have to go out and grab one of Jupiter's larger satellites, and then there's the problem of A) getting it into the right Hohmann transfer orbit and B) doing the Earth orbit insertion once it gets here, neither of which is a small boost.

    Then again, we have some time to work on the details .. ;-)
  16. Re:Erm, well... on Microsoft Asks Slashdot To Remove Readers' Posts · · Score: 1
    If I'm not mistaken (IANAL, naturally), actually hosting the material is illegal. BUT, linking to it is perfectly fine.
    I can't believe that anyone would hold me responsible for anything I post a link to. How the fsck do I have control over what someone else's website says? My linking to it merely says that I found it interesting and would like other people to find it more easily.

    Again, the only people that win this argument are the lawyers.
  17. Re:Great! on Welcome To The New Slashdot Server · · Score: 1
    Oh, come one guys, Katz isn't that bad...he's a great author, even if he misses the finer technical points. The guy watches out for the geeks. Yet you spurn him.
    Yeah, and he even got a sidebar in Time this week .. or was it last week? .. must have coffee ..
  18. Do NOT hit yourself in the head with this hammer. on Another Hole in Hotmail · · Score: 2
    Then, when the ILOVEYOU crap started, I had to send 2 separate emails with all caps in the body and a header that read "READ THIS!!" or something to get their attention. In it I said not to open attachments. Several people stopped me to ask; "Is it okay to open attachments?"
    I've always wanted to leave a claw hammer on my desk with a note attached that says:
    This is a hammer. Please do not hit yourself in the head with it. Hitting yourself in the head with this hammer will cause serious and permanent brain damage.
    That way I have something to point to when someone asks me if it's OK to open email attachments. Doesn't work too well over the phone, but I'm sure I could make use of a suitable GIF on the web server..
  19. No, I wouldn't. on Another Hole in Hotmail · · Score: 2
    I wrote a little "application" that was a simple little dialog box that asked the user if he wished to format the hard drive (in so many words) to see just how many of our in-house users really read those messages - and attached it to an email sent to everyone in the office (around 150 users). (Results were then sent to my computer through TCP connection, for those interested) 1 out of 3 users clicked yes..
    Did you then go back and resolve the IP's to machine locations and send anonymous emails to the users saying "You, sir [or madam as the case may be], are a FOOL!"?

    Why would anyone in their right mind let unknown people run foreign code on their machines? Yes, I get executable attachments sometimes myself, but why would I want to run code that does who knows what? I guess I just know too much about the kind of people out there. Yeah, maybe that's it.

    Just goes to show, once again, that there are two kinds of people in the computer world -- those who know what they're doing and understand the technology, and those who are along for the ride and depend completely on their "gurus" for anything even the slightest bit off the routine.

    I have to rant a little about this because around here 9 times out of 10 people come to me to bail them out when they screw something up, and only one of my jobs pays me for that. I have very little trouble believing that quite a few people would answer "yes" to your question, and not much more trouble believing that they would come whining to more clueful people about getting their files back afterwards.

    ("No, you don't understand. You FORMATTED the hard drive. That ERASES the hard drive. Unless you backed up those files which were ON the hard drive, they're gone. Sorry .. have a nice day ..")
  20. Re:Stuck "On" pixels vs. Stuck "Off" on Flaws in LCD Displays? · · Score: 1
    Check with your manufacturer. Some have different acceptable thresholds for stuck "On" vs. stuck "Off" pixels, since the "On" pixels are usually more annoying than the "Off" ones.
    Makes sense, particularly if you watch DVD's on your laptop -- although if a pixel has one fail-dark color in it, you'll still see a noticeable color spot on a white field like a text window. I would also suspect that since there's a transistor in the equation and they tend to fail shorted, that affects the distribution of stuck-on vs. stuck off somewhat ..
  21. Replacement policy on Flaws in LCD Displays? · · Score: 1
    So, might as well call whomever you bought it from and tell them there are bad pixels on the display, and that you need a replacement unit. If they tell you that you need X number of bad pixels, just start being an asshole about it, and they'll probably see it your way ;)
    Trouble is, any manufacturer with any sense won't tell you what the spec is for a defective TFT, simply because they can't afford to give away that many free ones. If you really work on them, they might ask you to tell them what your screen has on it, and then tell you yes or no as to whether they will replace it for you, but unless they're fools, that's as far as they'll go. Sorry, but if they replaced every TFT with one defective pixel they'd be out of business ..
  22. amazing! thought it was just low traffic on beta.. on Welcome To The New Slashdot Server · · Score: 1

    I was curious as to how well this new server would stand up to the traffic .. it appears to be about as fast as beta was, which is a SUBSTANTIAL improvement in refresh time. Yes, believe me, I noticed.

    Now I don't have to minimize Netscape and go back to work whenever I click onto a Slashdot page .. and come back minutes later to find it still loading ..

  23. Re:Mental Judge on RIAA Claims Initial Legal Win vs. Napster · · Score: 1
    Is the judge a retard? They just ruled that an ISP is not liable for what passes through their networks and now they do this?. Our legal system is seriously fscked up.
    Ah, but you forget .. the RIAA has *money*. That changes everything, since at that point it becomes a "my lawyers (plural) can beat up your lawyer (singular)" contest. Logic and any concept of fairness tend to go out the window in situations like that.

    A similar question would be: What does a 500 pound gorilla get to eat for breakfast? Same answer in both cases.
  24. FINALLY!! on GPS Civilian Signal Degradation Turned Off · · Score: 1

    I guess I don't have to mention that the DoD has been promising to review Selective Availability for years now, always hinting that it "may" be shut down RSN. Good to know it's finally going to be turned off.

    It can be selectively degraded, I guess, for large geographical areas, although that involves mapping out satellite ground tracks and dithering the clocks on a real-time basis, or possibly very big anti-pseudolites a la DGPS. Wouldn't be cheap, and considering we're about the #1 terrorist target, probably not practical. If DoD has a better way to do it, I'd be very curious ..

  25. Re:Disgruntled Help Desk Tech on What Is Important In A User Interface? · · Score: 1
    My dream is that a UI will be able to test the user for average intelligence then bring up an interface that is on the level that the user is on.
    How about a 'User Parameters' control that allows the user to select how verbose the dialogs are, how much help the user wants with using the OS, and how much protection they want from doing stupid things like reformatting their startup disk?

    I agree different people have different needs, and giving an expert user enough functionality to make the system useful is incompatible with protecting a novice user from their own mistakes. Then again, see following ..

    But Above all, make it stable! Even if they have 50 million applications open and a huge Access Database plus Oulook, make it so it doesn't crash and my life will be a whole lot simpler!
    Fine, as long as you can take all the developers that write third party apps for your OS/UI and lock them in your basement and feed and water them regularly. If they don't work for you, keeping their UI's consistent with yours and keeping their apps from walking on each other all the time is kind of like herding cats.

    Then there are the one that decide to get cute and use undocumented internal stuff in your OS to get that 0.1% performance increase and then gripe at you when their code breaks with your next release .. but I won't go there ..