Slashdot Mirror


User: numbsafari

numbsafari's activity in the archive.

Stories
0
Comments
150
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 150

  1. Re:When Will Apple Learn on A Little .Mac Security Flaw · · Score: 1

    I'll respond to the last part of your post since you think its something "the public" should be concerned about...

    Basically it's this: the value proposition (as I see it, I'm fully expect others see it differently) from Apple to me as a consumer is that the provide a full range of computing devices and services for both work and entertainment that encompass a very broad spectrum of my lifestyle and that are integrated in a very nice manner. This is what I mean by "vertical integration". Everything in their "ecosystem" is integrated and is engineered to work together. Without getting into a big debate about Microsoft, let me just say that they are a lot like Microsoft except for this one fact: their suite of products is more complete and Apple exerts much more control over all the moving pieces in an effort to produce a higher quality overall solution.

    It's that integration that makes Apple's products more valuable. That's what all their design effort really goes into. That's where it pays off.

    There have been a number of recent articles/debates/discussions/etc. concerning the idea of a "monoculture" primarily as it relates to Microsoft. The general argument goes that since we all depend so much on Microsoft products then a serious flaw in those products could result in a serious "doomsday" scenario for all of us. Botnets are a great example. However, a similar problem faces anyone using a high integrated system that is sourced primarily from one vendor. Sure, it doesn't have the same cultural/social significance as flaws in Microsoft products. But for the individual/corporation/group who is invested in that technology, it does pose a significant threat.

    So, the issue for Apple, as I see it, is that a security vulnerability that can be used to attack that highly integrated system could result in a dangerous situation for that individual. This is entirely hypothetical.. but, go with me.. a flaw in the .Mac security that prevents a user from logging out of their iDisk in an effective manner (this is really just an issue of UI design and one that, I agree with those who post above, is questionably solely an Apple problem or even an iDisk problem and more likely a browser design issue) could potentially grant someone access to their iDisk... if there were a further flaw that would let me manufacture access to your overall .Mac account and from there access to your personal information I could then steal your identity. Or perhaps download incriminating pictures of you that were backed up from your iPhone. Or change your password and security questions so that you no longer have access to your account. Or perhaps even then exploit that .Mac or iDisk access to connect to your machine at home via "Back to my mac" and trash your harddrive and then delete all your iDisk data.

    As all these things become connected, they all become interdependent. Interdependence is good because it creates value. But it's also poses this problem that dependent systems are just that, dependent on each other. One's failure could mean the other's failure.

    So, that's my reasoning there.

    Also.. if you don't see the connection between a policy of secrecy and disinformation on even the most pointless of issues (related to security or not) and overall security... I don't know that I can help you. I would think everyone who reads /. regularly knows the inevitable results of pinheaded, PHB corporate behavior.

    I don't mean to single Apple out in any way. I really do generally enjoy their products and they have been lovely to deal with from a support perspective when I have had to do so. However, I think I am not alone in my rational concern over this type of behavior and what it means for them overall. The irony of their 1984 ad campaign and this pattern of behavior is not lost on me.

    I can like Apple and be disappointed by them at turns as well, thank you very much.

  2. When Will Apple Learn on A Little .Mac Security Flaw · · Score: 5, Insightful

    I am an new Apple user. And reasonably happy.

    However, there is one thing that I am very troubled by and it is simply this: Apple apparent arrogance and ignorance when it comes to security.

    Apple has enjoyed a "blanket" of security because it is low profile and a niche. However, as its market share and mind share expands, this period of respite will soon fade.

    You would think that, during this time, Apple would have used the opportunity to develop and internal culture, policies and procedures, as well as infrastructure for dealing effectively with security issues. However, the complete opposite appears to be the case.

    Apple has failed miserably to publicly and actively address such issues. It also fails to respond in anything that could be called a rapid manner to reports of exploitable security holes. Taking actions such as deleting posts that point out security problems makes the situation worse, not better. Failing to publicly document the existence, status and nature of defects makes the situation worse, not better. Being secretive makes the situation worse, not better.

    Apple makes decent hardware. Leopard is very nice to use, though far from perfect. The whole ecosystem and vertical integration is nice. However, the whole thing could come crashing down because of a serious security flaw. If people think Microsoft is susceptible to such a scenario, the Apple empire is even more so.

    It's not a question of if, but when. Will Apple be prepared? So far, all signs point to "NO".

    PS... the CAPTCHA word for this post was "condom".. how appropriate considering the whole point is to have a good profolactic. A good metaphore for Apple's current approach to security.

  3. you misunderstand the point on AT&T Wireless Network Is Open Too · · Score: 1

    What you are talking about is whether or not you have ACCESS to the network. Obviously, you need to somehow PAY AT&T to get access to the network.

    What AT&T (and Verizon) are saying is that they will make it possible to use devices on their network. Currently, Verizon is very restrictive about what devices can work on their network. Basically, you MUST buy your phone from Verizon and it MUST be one of the phones they authorize.

    In the case of AT&T you were always able to buy another GSM device and put your AT&T SIM card into the device and use their network. My girlfriend uses a 5 year-old Nokia that she bought on-line from a European cell company. You can't buy the phone in the US. But it works just fine... with T-Mobile and now to AT&T (we switched since I got an iPhone).

    Obviously you have to pay to use the network (as in roaming, you are paying your carrier and they are paying AT&T for allowing you to roam onto their network). Just because they limit the number of available slots for roamers doesn't mean they are "closed" to the devices.

    It's two different issues.

  4. You're kidding right?? on Microsoft Planning to Buy Open Source Companies? · · Score: 1

    That movie was so fscking horrible.

    I think the only word that comes to mind is "masturbatory".

    I also think it was absolutely horrible to imply that Bill Gates is a murderer or that he would kill people for a profit. I don't know Bill, so maybe he would, however I don't see any evidence that that is who he is.

    Steve Ballmer on the other hand.... well... he does have a temper.

    Regardless, the movie lacked any merit. Watch "Hackers" instead.

  5. Re:Are books like this relevant any more? on Practical Ruby Gems · · Score: 2, Interesting

    But this book isn't about learning the language. It's a catalog of third-party packages you can use with Ruby.

    A book that documents something that isn't going to change, or develops a concept that requires more than 20 pages of text certainly deserves to be a book.

    But a shopping list belongs in a PDA.

  6. Re:Practical RubyGems on Practical Ruby Gems · · Score: 2, Interesting

    Consider all the effort that an author puts into compiling such a book as this? Then consider the editor, the typesetter and graphic designer, the pre-press preparation, the printing, marketing and ultimate delivery of a book that is out of date as soon as the contract to even publish it has been signed.

    What if the author simply kept an up-to-date web site with rankings and reviews, removing projects that have gone dead and indicating which projects simply reinvent and which projects actually move the ball forward? What if the author charged a fee for accessing the site and getting updates? Even for a measly $5 per subscriber they would make money.

  7. Are books like this relevant any more? on Practical Ruby Gems · · Score: 2, Insightful

    Does anyone here remember books like O'Reilly's "The Whole Internet" (http://www.oreilly.com/catalog/twi2/index.html)?

    With things like blogs and wikis are dead tree versions of these sorts of catalogs really useful or relevant any more?

    The debates here on slashdot rage on about global warming and being "environmentally friendly"... yet how can anyone support a book like this when it could just as easily have been published as a web page?

    I stopped wasting time and money on books like this ages ago. I cannot for the life of me understand why people still bother.

  8. ACH isn't such a good idea... on Driver's License to be the Next Debit Card · · Score: 1

    If Gas stations were so into the idea of using ACH then why don't they just accept personal checks??

    Because nobody likes bounced checks. That's why.

    Sure, you have to deal with chargebacks, etc. But the credit networks provide resolution procedures, etc. for these things that are much better and efficient than those provided by ACH.

    Gas stations should really be promoting pre-paid, private network cards so that they can bypass this altogether. What these guys should be providing is not an ACH transaction tied to a bank account, but a prepaid debit account that runs over their own network.

    They would earn their money from float and processing fees charged to the account holder. Heck, they could charge a penny per gallon from the merchant and still make a good sum.

  9. Re:what's the purpose of a language, anyway? on PHP Application Insecurity - PHP or Devs Fault? · · Score: 2, Interesting

    Agreed: developers should absolutely take responsibility for the code the write.

    And people should take responsibility for the cars they drive and the pollution they create.

    Of course, it would seem to me like a lot of people believe that there's a certain social value in asking the producers of cars and heavy equipment to improve the quality of their products.

    As with anything, one should select the right tool for the job they are trying to do. If you need to write a complex site, pick a tool that allows you to do things that are more complex. Of course, doing so means you need to be aware of what that complexity means and take responsibility for the increased risks.

    However, PHP sells itself as the "easy to learn", "user friendly language" of the web.

    As someone noted earlier in the thread, user friendliness often times includes safety matters. Sometimes, safety scissors are warranted.

  10. Re:what's the purpose of a language, anyway? on PHP Application Insecurity - PHP or Devs Fault? · · Score: 2, Insightful

    Sure, but what good is it if the content happens to be spyware or a root exploit?

    I mean, you could make the same degenerate argument about Windows and OS's, but something tells me it would sound just as lame.

  11. agreed! on PHP Application Insecurity - PHP or Devs Fault? · · Score: 1

    I have to say, part of the quality of the "tutorials" and documentation provided by the language proponents should probably be taken into consideration.

    For example, a while back I was reading the Microsoft training materials on .NET Web Services. The example instructed the developer that they should generate their primary keys by selecting the MAX of an int column, adding one and then inserting the new record.

    I can understand not wanting to confuse someone with the complexities of concurrent programming when you're just trying to introduce them to the UI for the compiler. But seriously, there was a two paragraph description of how to do this. One could certainly fit in a description of using identity columns or some other reasonable approach rather than selling this other mess as a good idea.

    And so, when MS complains that their devs get no credit... well... one only has to point to the quality of the manual they were supposed to learn from.

    Sounds like PHP suffers from the same problem.

  12. SQL escaping considered evil... on PHP Application Insecurity - PHP or Devs Fault? · · Score: 5, Informative

    I kind of agree with where you are going, but I would add the following point:

    SQL Escaping is evil.

    Why?

    Because no user input should ever be executed. EVEN if it is escaped. The problem is that the escaping can be invalid and buggy and thus, insecure.

    People should use parametric SQL statements. No excuses. In this manner, no escaping is ever necessary.

    A separate issue is what to do about displaying user input. Here, things are more problematic, especially in the world of HTML. What would be nice is if we all got together and redesigned "the web" so that user input could be handled in a manner similar to parameters in SQL.

    Obviously, there's a difference between data in tables and data in a formatted page. But I'm sure something could be done.

  13. what's the purpose of a language, anyway? on PHP Application Insecurity - PHP or Devs Fault? · · Score: 3, Informative
    The question, as I see it, is what really is the purpose of a programming language?

    I mean, why can't we all just write our code in assembly language and get it over with?

    The fact of the matter is, that a programming language is a productivity tool. It is supposed to enable the programmer to more simply express complex actions rather than having to deal with all of the low-level particulars.

    PHP advertises itself thus:

    PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. So, PHP claims to be "especially suited for Web development". Given that one of the primary concerns of web development should be security, I would expect that the language, and the core libraries that are packaged with it, would promote and encourange safe programming practices.

    So, should the language be "idiot proof"? No, not necessarily, but it should certainly make secure programming hard not to do.

    A good example of this approach is that taken by the OpenBSD project when it redesigned some of the low-level C library string manipulation functions to make them "more secure" in that they eliminated the programmer's ability to make certain, common, mistakes.

    I don't look at this as a "stupid" versus "smart" issue. It's a "does my programming language help me do X or not?" issue.

    So, stop blaming the programmer and find ways to make their already busy lives easy.
  14. Yahoo! Mail on Easy Throw-Away Email Addresses · · Score: 1

    Yahoo! Mail let's you do this.

    I see people talking about gmail's similar solution. The difference is that with Yahoo! Mail the prefix MUST be different than your regular email address... which means that, unless they can tie both emails together through other means, they can't just strip away the suffix portion.

    Unique Email Addresses are a good idea in general, but don't fool yourself in thinking that a web site operator can't tie you back to your IP or based on the physical address or other information you give them in order to know that you are using multiple email addresses that all point back to you.

  15. Re:Irrelevant on When Stallman is Attacked · · Score: 2, Funny

    Actually, he's been HURDing it for YEARS!

    Haha... hoohooo.... woah... sorry... bad joke...

  16. Re:giving back on IE Sends Cake to Firefox 2 Team · · Score: 3, Funny

    Only if they've been drinking heavily or have the flu.

  17. Re:the usual responses on Apple Unveils MacBook Pro with Core 2 Duo · · Score: 2, Informative

    Yes, you are correct. I meant the FSF, not the EFF.

  18. Re:the usual responses on Apple Unveils MacBook Pro with Core 2 Duo · · Score: 1

    Actually, I was trying to install Ubuntu over the summer on my machine. Unfortunately for me, I had a D-Link wifi card. In order to isntall the driver I had to get the driver source. And I also had to have the correct version of the linux kernel source. Once I got those two things together I was able to compile the driver into my kernel.

    You probably haven't upgraded much of the hardware in your thinkpad, and ubuntu probably already shipped with the right drivers compiled in.

    Sorry for singling out Ubuntu on this one. I have the same issue with FreeBSD and OpenBSD.

  19. Re:the usual responses on Apple Unveils MacBook Pro with Core 2 Duo · · Score: 2, Insightful

    Switcher:

    Linux requires me to think too much (recompiling the kernel to install a driver? -- why would a home user ever want to do that??)

    Dell has had the Core 2 Duo for a bit, but I'm sick of using Windows and dealing with MS security issues, MS DRM policies, MS licensing changes... and on and on...

    Mac OS gives me the best of both worlds: a unix environment that is incredibly user friendly because it drops the nauseating hypocracy of GNU and the EFF... I don't have to recompile anything to install a driver.

    Is the Apple solution the best solution in any particular category? Yes: user friendliness. It still has DRM, the hardware is expensive and isn't always the best. It's not fully OSS...

    But as an all around package? No one does it better.

  20. Hold on... on What Earth Without People Would Look Like · · Score: 2, Insightful

    While I kill myself to repent...

    What a stupid and lame discussion. Of course we have an impact on the earth. So do insects, cows and bacteria.

    The rocks would be happier without the moss.

    The questions shouldn't be about what if we all leave, they should be about how can we maintain an environment hospitable to us. That includes reducing pollution and expanding the "wild zones" and "gardens" of "terra firma".

    Should we all just stop existing because, oh dear, we might actually have an impact on the rest of the world?

  21. Open SSL? on Free SSL VPN Solutions? · · Score: 2, Insightful

    The question is lame. Personally, it sounds like someone trying to get traffic driven to their site than a genuine Ask Slashdot.

    I'm a bit confused, too, about why IPSec is a requirement if you are looking to use an SSL VPN?

    In the meantime, just check out openssl.org.

  22. Re:I like this idea on Amazon Wants Patent for All-You-Can-Eat Shipping · · Score: 1

    Quick, patent these:

    "A system and apparatus for automating 'mini-patent' reviews."
    "A system and apparatus for awarding 'mini-patent'."
    "A system and apparatus for resolving disputes of 'mini-patents'."

    Then we can license it back to the USPTO who will have to pay a fee for every mini-patent they review!

    No more ads on slashdot!

  23. Re:Avoid the bash and move straight to the tangent on What Does the Microsoft ODF Converter Mean? · · Score: 1

    My father used to work as an editor of military history books and publications.

    All of the publishing houses switched to Word because they could use the editing and revision tracking features.

    My father also published a magazine for a veterans organization--using Quark.

    My girlfriend publishes a perfect-bound, high-quality magazine. All articles are submitted in Word form, handed over to the layout guys who work in Quark who then give it back to her in PDF form.

    By and large, people write using word processors and publish using publishing tools. I haven't met a "typesetter" yet who uses TeX or LaTeX. They've all used Quark or (sadly) Pagemaker. I'm sure they are out there, but they aren't the majority by a long shot.

  24. Re:Advertiser Fraud on Google Launches Cost Per Action AdSense · · Score: 1
    Trust me, fraud isn't going to be a drop in the bucket because if it worked you'd have every advertiser beating down a path to Google to pay up for some of that Step 3: profit!


    That's my point: the advertisers will go where the money is. And if there's a way to save even more on the click-through advertising, why not do that? Come on, just a little bit!! Right??

    I'm not worried about anybody defrauding the advertisers. I'm worried about advertisers defrauding the publishers.

    Google's job will be to operate as an object third party, a clearinghouse. This happens all the time in capital markets. The difference is that, typically, clearinghouses are non-profits whose income (if any) is shared amongst all parties involved. In the cases when they aren't, there are small things like the SEC and NASD to act as police.

    I just don't think Google's the right player for the job in this case. All the incentives are wrong.
  25. Advertiser Fraud on Google Launches Cost Per Action AdSense · · Score: 5, Interesting

    I worked for a company back when no one cared about making money and we were looking at building something similar. One of the chief concerns we had at the time was how to prevent fraud on the part of the advertisers: ie, if a user clicks through and ultimately makes a purchase, did the advertiser properly track that and then report it back?

    There are a couple of ways publishers can also loose out: for instance, if a user clicks through but doesn't make a purchase only to return to the advertiser's site the next day or week and make the purchase, will the publisher be compensated appropriately?

    This is definitely a great opportunity for publishers and advertisers by increasing quality over quantity. However, there are a lot of potential pitfalls for the publisher.

    Will google be able to properly intermediate? or will they tend to side with their big advertisers when issues/complaints arise?