Slashdot Mirror


User: TheLink

TheLink's activity in the archive.

Stories
0
Comments
12,789
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 12,789

  1. Re:html tag to disable active content on Reddit Javascript Exploit Spreading Virally · · Score: 1

    > You can't assign attributes to end tag

    I don't care how the brake pedal looks, as long as it works and is easy enough to use. There's stuff like DOM and AJAX to consider, so it might not be as simple as that, but my point is we should have at least one useful brake pedal.

    > What we actually really need, and what is the real solution, is just a little more careful programming on the server side.
    > Prove mathematically that no input shall ever produce broekn otuput. Simple.

    That's either ironic or insightful or +5 Funny or all of the above ;).

    Imagine if the whole Car Industry tells you "If you want to stop, just make sure none of the 100+ gas pedals are pressed" and it's not their problem if some of the gas pedals are located in the strangest and most unexpected places. And the Car Consortium says "Oh by the way, we're going to release a new gas pedal in 2010 - we haven't quite decided what it is, and some of the car manufacturers already have their own ideas, but be sure to take care of those as well okay?".

    Well maybe I'm seeing things wrong and the W3C and browser people are right. It's just crazy old me I guess.

  2. Re:html tag to disable active content on Reddit Javascript Exploit Spreading Virally · · Score: 2, Insightful

    That's all very nice and simple till stuff like UTF8, UTF7, etc get involved...

    See:
    http://nedbatchelder.com/blog/200704/xss_with_utf7.html
    http://www.securityfocus.com/bid/31183/discuss
    http://ha.ckers.org/blog/20060817/variable-width-encoding/

    You don't have to believe me when I tell you there are 1000 (or more) gas pedals and no brake pedal and it's a crazy situation. But that's the truth as I see it.

    I daresay many of the website folks who have been burnt before will believe me. Yes you can and SHOULD use the escaping libraries out there, but you'd still be screwed the day some hacker discovers a way to exploit a browser bug or new "feature" or even an ambiguity in standards[1] that causes the browser to see things differently from what the library handles.

    My memory isn't so good but I think there was even a case where a browser treated some unicode characters as "" for some reason with exploitable results.

    [1] Both the browser and library could be "right" but that's no comfort to your exploited users and you.

  3. html tag to disable active content on Reddit Javascript Exploit Spreading Virally · · Score: 4, Insightful

    Years ago I actually proposed to the W3C and the mozilla bunch to add a tag to disable dynamic stuff like javascript.

    Basically it would work something like this:

    <shield lock="some_random_hard_to_guess_string_here" enabled="basic_html_only">
    The browser will only recognize basic HTML stuff here, it won't recognize javascript or any _future_ dynamic stuff that the W3C or browser people think off
    </shield unlock="some_random_hard_to_guess_string_here">

    The some_random_hard_to_guess_string_here would be different for each page.

    The idea is while the website should still have filters, even if in the future the W3C or browser wiseguys create some new fangled way of inserting javascript or some other dynamic content that the filters do not protect against (since it's new and the filters have not been updated), the browser will just ignore the new stuff that some hacker inserts when it's between the tags.

    To me the current state of things is a bit crazy - basically it's like having a car with 1000 gas pedals (tags) and to stop the car you have to make sure all 1000 pedals are not pressed (escaped or filtered). There is not a single brake pedal! And worse, the W3C or MS or Mozilla or whoever could introduce a new gas pedal, and you the website operator have to filter out the new gas pedal when it's introduced.

    With something like this tag there is a brake pedal, so even if you don't manage to filter out all the 1000 gas pedals, the brake helps to keep stuff safe.

    If they had implemented such a tag, the google and myspace worms would not have worked for so many browsers.

    FWIW, these sort of worms are not new. I managed to find a hole in advogato some years ago (iframe worm) - and hence my suggestion to the W3C and Mozilla.

    But it seems to me than NONE of them are really interested in improving security. They're all just interested in inventing new gas pedals for people (and hackers) to step on. They're not even interested in creating a single brake pedal. They just pay lip service to security.

    See the thing is - it's not too difficult to code a browser to go "OK from now on there's no such thing as javascript till I see a valid unlock tag", so even if there is a browser parsing bug and a hacker manages to insert javascript via a stupid browser bug (that the website filters naturally do not and cannot cater for) it does NOT matter - since javascript will be disabled - between those tags the browser will be respecting the flag that says "I do not know javascript, java and all that fancy stuff" - it does not even have to parse javascript - since for all intents and purposes between those tags, the browser does not know there's such a thing as javascript (or activex or flash etc).

    This is very useful for sites that have to include 3rd party content - sites like slashdot or webmail sites or even sites that serve up ads from 3rd parties.

  4. Agent Provocateurs on G20 Protesters Blasted By "Sound Cannon" · · Score: 1

    There's this:

    http://www.youtube.com/watch?v=St1-WTc1kow

    Of course the report in the news says otherwise:

    http://www.ctv.ca/servlet/ArticleNews/story/CTVNews/20070822/montebello_cops_070822/20070822?hub=TopStories

    But check the comments and see for yourself:

    e.g. "Watch as the three men start to realize that they are being accused of being undercover cops... they say nothing, except for the one man in the back who leans over and exchanges a few words with one of the riot cops. Then, suddenly, three men who had been holding stones and getting ready to cause trouble suddenly walk peacefully right into the police line and are led away"

    And there was no record of the provocateurs being arrested.

    Whether it's something "typical" or not, I don't know. But sure looks like it does happen.

  5. Re:Crosswinds on New Motorcycle World Speed Record, 367.382 mph · · Score: 1

    And what's wrong with that? As long as you're not taking anyone else out with you, or costing other people billions of dollars in damage.

    Heck it might even work out to be less total effort to clean up the resulting mess, than cleaning up your messes if you have dementia, incontinence etc for 15 years before you finally keel over.

    But hey, I'm the sort of person that thinks smoking shouldn't be banned (except in places where it'll cause a "fireball"), it should just be taxed heavily - after all in the UK smokers cost the NHS 5 billion pounds, but they pay 10 billion in tobacco taxes, so as a nonsmoker I'd say it's a good thing....

    So hey, if you're some retired person in a "developed nation" and want to take up super biking or mountain biking, smoking, sky diving, ingesting large quantities of lard or freedom fries or deep fried mars bars go right ahead. Even better if you're on a government pension. And if you do the "flaming fireball through pearly gates" thing, perhaps the country should give you a posthumous medal.

    Stupid Countries and Governments keep worrying about "aging populations" but in the next breath keep discouraging the people who are helping to solve the problem...

  6. Re:vegetarians on Cooking May Have Made Us Human · · Score: 1

    The point of the article is the digestive system for most humans has significant subsystem that's outside the body. In some places it's called the "kitchen" and the digestive process that occurs there is called "cooking" and "food preparation".

    But yes if you and your line of descendents solely eat raw and unprocessed plant foods and somehow do not die out in the process, it is likely that some sort of adaptation would have to occur, and it may include the increase of stomach size or the number of stomachs, or eating "rabbit style", or eating "panda style" (spending most of your hours eating due to digestion of your food being inefficient ).

  7. Re:Why do we sleep? on Alzheimer's Disease Possibly Linked To Sleep Deprivation · · Score: 1

    But is being woken up by an alarm clock every day much healthier?

    As compared to waking up when your body says "hey time to wake up".

  8. Re:Space station supply on SpaceX Announces Dragon As First Falcon 9 Payload · · Score: 1

    But I don't think it's that great if their rocket succeeds because of good luck.

    Maybe wish them "no bad luck" ;).

  9. Re:ridiculous references on Ants Vs. Worms — Computer Security Mimics Nature · · Score: 1

    Maybe the reason is if people understood it, they'll know it's mostly bullshit or useless.

    Having stuff "wander around" networks isn't going to be very useful, especially when you don't want stuff wandering around all your networks in the first place.

    What might be useful is machines that raise an alert when they think something is going wrong, or even quarantine themselves (or networks). I believe such systems already exist.

    Anyway, just put some controls over info flow via firewalls and proxies. Then get users to store their data on fileservers (so they can be backed up easily) and have the desktops use stuff like "Windows SteadyState" (there are hardware versions of such stuff too).

    Laptops are a harder problem. But I don't see how the "ants" would help for laptops either.

  10. Re:BIOS on New Phoenix BIOS Starts Windows 7 Boot In 1 Second · · Score: 1

    In most cases you won't get that kind of uptime from a Linux box either if you bother with every kernel update, since you have to reboot for the kernel update to take effect. Recently this has changed with ksplice - but looking at the changelog, I'm not sure if you would want to trust your production systems with it just yet.

    If you really wanted that sort of uptime you would be running something like OpenVMS or Tandem. Those sort of systems can have uptimes of _decades_.

    Turns out, in the real world, nobody really cared that much... I figure by the time people start caring again, vmware and gang would have kind of reinvented the wheel again ;).

  11. Re:BIOS on New Phoenix BIOS Starts Windows 7 Boot In 1 Second · · Score: 4, Interesting

    Actually you'd think most people would want servers that are infrequently rebooted to come back up really fast.

    But yeah, you can't spin up that many drives at once. I've heard a server where the drives were making up and down "pitch" changes during boot up... Not good :).

  12. Re:Effectiveness on AIDS Vaccine Is Partially Successful · · Score: 1

    > The big news is that it appears to be either 100% effective or 0% effective for any given person

    Not necessarily. The vaccine could just reduce your odds of getting HIV but still not make you 100% safe from HIV. It's like seat belts improving your survivability while not protecting you 100%.

    It's not as if they proceeded to take a random sample of both populations (that don't already have HIV), inject them with HIV over a course of a few months and see what percentage are near 100% immune.

    Heck, maybe the vaccine made people feel like having less sex, or had some other effect. ;)

  13. Re:Protection? on 250-Foot Hybrid Airship To Spy Over Afghanistan · · Score: 1

    Untrapped helium floats to the top of our atmosphere and a fair bit of it will leave the earth - because it can attain escape velocities at that point.

    http://www.astronomynotes.com/solarsys/s3.htm

    Recovering the helium that's floating up there will be very expensive.

  14. Re:Solar Thrust on 250-Foot Hybrid Airship To Spy Over Afghanistan · · Score: 1

    Let's see: 40 pounds for Solar Cells that produce 1200 watts and 71 pounds for the associated batteries.

    How many watts to move a sizeable airship at say 20 knots or 80 knots dash speed?

    Seems the payload of the Ares airship already requires 73 kilowatts. The solar cells just to produce 73 kilowatts will be 1100kg, add the batteries and you're looking at a total of 3000kg just to power the payload. Which is more than the max payload of the ares.

    OK let's ignore that payload and just say we carry a dead payload that doesn't require 73kW (or air conditioning, lighting etc) and ignore the battery weight - no batteries so 1100kg = 2400 pounds. 73kW is about 100hp. I haven't the time to look up how power the engines of a typical airship of that size need to be to move it at about that speed, but I doubt 100hp is going to be able to move an airship that can carry 2500 pounds at 20 knots (23mph, 37kph), in still air. That's a lot of air to push away.

  15. Re:Protection? on 250-Foot Hybrid Airship To Spy Over Afghanistan · · Score: 4, Informative

    1) Are they really more efficient?

    They're certainly better than helicopters for hovering and slow patrolling, but for transporting lots of people or stuff to a definite destination I doubt it. Given the typical shapes used, I can imagine them spending lots of fuel just fighting the wind or air resistance. Not going to be easy to beat ships or trains, or even normal planes.

    Airships are fuel efficient if you don't mind going wherever the wind blows you.

    2) What gas to use though?

    I don't think there will be enough helium to go around:

    http://www.wired.com/wired/archive/8.08/helium.html
    http://www.usatoday.com/news/nation/2007-12-02-Helium_N.htm

    So the options are hot air (which doesn't produce as much lift) or hydrogen (which has significant PR problems for airship usage).

    I suppose this would be a smaller problem. Could use hydrogen both for fuel and for lifting.

  16. What makes eyefinity better than nvidia's stuff? on AMD Radeon HD 5870 Adds DX11, Multi-Monitor Gaming · · Score: 1

    But what makes Eyefinity so different or better from Nvidia's tech?

    For years Nvidia already has tech that allows you to have 2 (or more - quadros support 16) monitors look like one seamless display to the O/S - that's called "span". Span behaviour is undesirable for most people though.

    In most usage scenarios, it is counterproductive to have X monitors look like one seamless display to the O/S when the real life image produced isn't seamless - nondisplay edges of the panels etc. So it's very silly to have your dialog boxes popping up spread across two or even more monitors, and your start menu button next to your left elbow.

    The Nvidia mode sane people use is called "dualview". When you use dualview, the O/S is aware of the monitors and does not plonk stuff across monitor boundaries. And you can also have your taskbar and start menu on just one monitor, rather than the O/S thinking it's all one huge monitor and stretching the whole taskbar across multiple monitors.

  17. Re:Come on... on Nominum Calls Open Source DNS "a Recipe For Problems" · · Score: 1

    Bind9's security track record compared to other DNS servers out there isn't that great either.

    So if the same people are still doing the same "great job" in Nominum, it's just one more reason to avoid them.

  18. Re:Well on Nominum Calls Open Source DNS "a Recipe For Problems" · · Score: 1

    We're not turning to "all bloggers", or the same blogger for everything though. Some bloggers do far better investigation and writing on their topics of interest than journalists do (which is not surprising).

    And why pay for newspapers that can't do better than bloggers with zero investigative skills?

    Commercial software is not going to go away even with OSS stuff around. Likewise magazines and newspapers aren't going to go away, but many of them are going to go bust because they add insufficient value.

    If your newspaper has nearly the same content as the other 2150 newspapers in the world that suck from the teat of Reuters and AP, why buy your paper in particular? Especially when the others are free?

  19. Re:Summary of /. Reaction to Proposal on Firefox To Replace Menus With Office Ribbon · · Score: 2, Insightful

    > One thing the new system does get right is that everything now has a keyboard short cut and everything is supposedly quicker to get to with less mouse acrobatics.
    > The real question is after a month or so of training and learning, who will be performing better and is that performance change (if any) worth it?

    The one who is using the keyboard shortcuts.

    Conclusion switching to the ribbon is a waste of time. Adding keyboard shortcuts and documenting them would be better.

    Lots of companies like to target their UI for naive users. Very few create UIs for users who will be skilled - except for stuff like games - there are games which allow skilled users to do very many "actions per second".

  20. Re:Doomsday Machine on Soviets Built a Doomsday Machine; It's Still Alive · · Score: 2, Insightful

    A lot of people here don't get it because they've been brainwashed by the US/western media to thinking that the USSR was 100% evil.

    Certainly the USSR were evil in many ways. But a lot of their arms build up was in reaction to the USA.

    If you look at things from a non-US perspective, it's often not that clear that the USA are the good guys and the USSR automatically the bad guys. Put yourself in the shoes of a USSR leader, would you be 100% sure that the USA will not attack your country? Just look at the USA's track record of intervention and regime change (yes I know the USSR weren't clean either - but see it from their side).

    Much Soviet military tech made more sense from a DEFENSE perspective, even if not as good as comparable USA tech for "projecting force". Especially "projecting force" to the other side of the world - which I consider a more offensive capability than defensive. Many people said the early shkval torpedoes were useless because of their short range. No they were still OK for defense. Or the USSR nuclear missiles weren't as good at taking out hardened missile silos (which is only a useful feature for offense).

    The "doomsday machine" helped the Soviet leaders save face and satisfy themselves that if the Evil USA nuked their homeland, the capitalist pigs will also be nuked to bits too. It is useless from an offense/"attack the USA" perspective, but it is by no means insane.

    However perhaps it would have made more defensive sense to vaguely hint to the USA that they had the ability to do that (but I'm sure there's a lot the NSA know that they aren't telling).

  21. Re:Not really... on Court To Scammer, "Give Up Your House Or Go To Jail" · · Score: 1

    Then he can give them his house and not go to jail.

    If he's stashed away enough assets, the opportunity cost of going to jail should outweigh the cost of his house.

    He can't sip a cocktail in the Bahamas if he's in jail.

  22. Re:Podcast? on Former Interplay Dev Talks "Disastrous" Old Star Trek Games · · Score: 1

    What happened to OSS voice recognition?

    Is there an OSS voice recognition software out there that I can use to create _passable_ text transcripts of such "podcasts"? I looked at sphinx some years ago and it seems to require way too much fiddling just to get "voice to text".

    Great if it's something as usable as: cat audiofile | speech2text --use-model model1 > text_transcript

    Apparently nowadays there's commercial software that has pretty good voice recognition.

  23. Re:Some would call X3 the successor... on Elite Turns 25 · · Score: 1

    > That's why planetary exploration should be done by AIs loaded into high thrust nuclear rockets

    In the time it takes for us to get AIs and high thrust nuclear rockets, we could send a fair number of robots to Pluto a few times :).

    Anyway, I think we should figure out how to make space stations with artificial "gravity" and decent radiation shielding. Once we work that and other little details out, it doesn't matter how long it takes to travel. You could then build a space colony where humans can live in indefinitely - reproduce, bring up children, etc.

  24. Re:Had a chuckle at this. on The Perils of Ramming Products Down IT's Throat · · Score: 1

    > Lets be honest here. How many of us are actually "top-flight"?

    Bingo! We have a winner here.

    So many people think they're "top flight". Truth is most of the employees and companies in the world are not top-flight. They can't be by definition :).

  25. Re:Develop a more positive view of the negatives. on The Perils of Ramming Products Down IT's Throat · · Score: 1

    > The technology is astoundingly great, and makes VM ware look like a $5 product
    > Most VM solutions require that you dedicate a single piece of hardware to a single image at a time

    But what do you mean by that?

    I can run multiple vmware instances on a single computer that _share_ the same network interfaces, CPU, hard drives and RAM.

    You're just making claims that hyper-v is great but not really saying why it really is great and better than vmware or xen or other stuff.