Wouldn't it rather be beneficial for the company to go public with this incident?
It would be the opposite of security-through-obscurity - security through publicity instead. By going public, any future attackers will know that if they indeed go after this target, it will be noticed, and the company will inform the CC companies, rendering the stolen numbers pretty much worthless. Compare that to if the company keeps the lid on - future attackers can then feel a certain degree of safety that any "obtained" card numbers will not be barred quickly.
Design: When doing design there are a number of things I consider critical for me to be efficient. o) Having the exact input specs available (either knowing them or being able to look them up very quickly). o) Knowing what output is expected, what the end user will want out of this project. o) Someone to bounce ideas off when I want to. o) No interruptions, including meetings, newbie questions (sign on door works well for that), or incoming nerf fire. o) When the above have been met, either
a) dark room, music loud enough to drown out the surrounding world, or
b) long walks, preferrably in average weather where I don't really notice what the weather really is like (i.e. not too sunny, not rainy, etc)
As for coding, my recipe is fairly "standard": o) Dark room, and if really dark, turn down the brightness on the monitor as well o) Lots of screen real estate o) Virtual desktops. Code on #1, reference code on #2, misc stuff on #3, browser on #4 (for instant net lookups of RFCs and what not). And, of course, xmms on all:) o) Hotkeyed E-term (or other transparent terminal) so that I can quickly run a couple of "intrusive" commands o) Vi (let's not get in a fight over vi vs emacs, but I can tell you that vi runs fine (6sec startup time) on my 386. Emacs doesn't;P ) o) Music. Normally one or two songs on infinite loop. The intro (and install) tune to the pc version of Magic the Gathering is a favorite. Only ~30 seconds long, but perfect on infinite repeat, especially when crossfaded. Other than that, techno is a good choice for me. As can Enya be. Depends on mood, although fast paced is normally most effective. o) Phone off hook (or used for dialup access). o) Doorbell disconnected (well, it always is anyways). o) Huge supply of chilled Coca Cola, within reach. o) Something to munch on (choc sultanas are good). Chips don't cut it, it gets the keyboard all greasy. o) A comfy chair (there is a reason I spent $400US on mine!) o) Having something interesting to code. That, would be the most important thing of all.
I think that pretty much sums it up though. Once in the zone I can stay there for 12-20 hours without a problem (unless interrupted of course).
Just because I might not like you, doesn't mean I won't respect your right to an opinion. I might disagree with everything that you say, and loudly so, but I won't deny you the right to say it.
Management doesn't know the software dev. process
on
Do You Like Your Job?
·
· Score: 4, Interesting
I had exactly the same problem at my last job (which I quit partly because of exactly this).
In that job, I ended up being the jack of all trades, running around and patching things up (not so much code, but design decisions, manager awareness, team skills, etc). And even though I put in a considerable amount of effort, the project still ended up slipping the dead line by a long shot (which was waaaaay too tight in the first place).
All throughout I constantly tried to look ahead and warn the project manager of dangers and difficulties that lay ahead that could endanger the project. Only to not be taken seriously, or simply being too late for management to be able to do something about.
To me it appears that management doesn't know the software development process very well. They expect things to be easy, quick, and impactless. Documentation is required, but no real time set aside for it. Design before coding is of course mandatory, but if we get any time at all that's a real surprise (in my experience). Getting the development environment set up with daily builds, automated regression test (and integration tests where possible) is given no attention. In my last project we were four weeks into the coding before we got a semi-working development environment. Go figure.
So well, my experience is that most project managers simply lack awareness of what is involved in a software development project.
One of my goals is to get around to writing a book; "The software development process explained" (or something) targeted directly at managers to help them get an understanding of what's involved and how it all interacts. And no, it won't be a tome, I'm hoping to keeping it to 2-300 pages, so a manager doesn't feel too intimidated by it.
As a bottom note, I am now employed doing second line global technical support, and while dealing with some customers can be quite frustrating and painful, the management here has a good idea of what they are doing. It makes a world of a difference. Even though I'm more or less on call 24/7, the stress levels are nowhere near what I had in my last development position.
If we think a bit closer about the quote:
"The limitation to this Pigeonhole Principle circumvention is that the multi-dimensional space can never be super saturated, and that all of the pigeons can not be simultaneously present at which point our multi-dimensional circumvention of the pigeonhole problem breaks down."
Bringing the multi-dimensional aspect down to a plain byte level, what they are saying is that as long as the byte only contains values between 0 and 3, they can achieve astonishing compression levels. Hell, even I could do a 64:1 with such an assumption =)
I'd say it's radio interference. On my old SoundBlaster Pro 2.0 I used to pick up Radio Moscow in my left speaker. Only the left.
(I was living in Sweden at the time, and that's not too far from Moscow).
I write my programs/utilities because I find a need for them, and there is nothing available that does what I need (or I just can't find it).
I release my programs to the public because if I found a need for it, chances are that someone else does too. And why should that person have to re-do what I've already done? Sure, there are times when I will want to restrict my works and put them under a more strict licence than the GPL, but those are not the common case.
And I certainly get a kick out of getting an email from a complete stranger saying "hey, you're program is great! Thanks!", or even the old bug report "I was trying to use your program, but...". It all means that someone else found it useful, and that is a huge kick for me:)
Having played CAVE-Quake, having the ability to actually move around instead of having to stand still in the middle and use the "joystick" would to me seem like a very nice improvement.
Someone mentioned the sound being a potential problem for the sphere, but unless you're after perfect digital AC5 surrond , I can say that it will not be a problem. The CAVE system I was using had a modest audio equipment setup, but explosions, grunts, rocket launches, etc sounded well enough for me. And the directional bit was accurate enough to locate enemies by sound as well.
The only thing is, that considering how disoriented I got after a few minutes playing, I don't want to find out how it would be inside a sphere =)
But I'm damn sure it'd be one hell of game experience! CAVE-Quake was just superb.. can't really imagine what a SPHERE-Quake would be like, except for "damn intense":)
Is it just me, or was it not a trade secret that was publicly posted on/. ?
If it was, I do believe MS can kiss that trade secret goodbye, since once exposed, it enjoys no special protections from the law, and is considered public knowledge (afaik).
However, the person who posted it is most likely responsible for copyright infringement, and can be sued.
Still, that does not hold/. responsible, since at the same instance the person posted it, the trade secret ceased to exist, and therefore MS has no claims to remove it. Or possibly, they could have that copy removed, but any copies made from that one would/should be considered public knowledge and thus out of their reach.
Do correct me if I'm wrong... these days it seems like a coder needs to be a lawyer in order to be able to write anything!
What would happen if a few hundred of us publicly claimed that "I was the single one who reverse engineered CSS"? Are they going to sue as all? If we claim the sole responsibility, would it not be illegal for them to sue all of as, as only one of us could possibly be guilty?
Anyone have any idea of the possible outcomes and consequences of doing this? (read: anyone know the appropriate laws well enough?)
If this is one (legal) way to give the MPAA a headache, I'm all for it.
Alright, enough is enough. I want to know if there's any chance we can counter sue, on what issues, how much, where, and who can do it.
I myself am located in Sweden (that's next to Norway, fyi.), and don't have the time or legal knowledge to do something like this myself, but I will gladly support anyone who can and will do this. Is there any chance the EFF will do something like this? Or at least backing those who do sue?
I'm not talking about Norway only now, I'm talking about counter-sueing on every possible front, in as many countries as is applicable. If they want to play rough, then so should we, on their own field, with their own methods. They may have the big money, but we have the numbers, and if every single one of us put in a few $ each, I'm convinced we could match them. (Just look at how widespread the DeCSS source is by now:) )
We can sit here and whine all we want while they trample us, but if we want to see some results, we should really enmass a counter strike on their own field. Answering how/who/what/where to sue is a good place to start I believe.
If there is any need for it, I'll gladly contribute with webspace and mailing list for such an issue. (In case/. gets too crowded;) )
Cheers, CoolGopher
PS. Those of you who haven't joined EFF yet should do so (that includes me, and I plan on doing it as soon as I get home from work today. I can't afford it, but I can afford it even less not to).
Slashdot Mirror
Wouldn't it rather be beneficial for the company to go public with this incident?
It would be the opposite of security-through-obscurity - security through publicity instead. By going public, any future attackers will know that if they indeed go after this target, it will be noticed, and the company will inform the CC companies, rendering the stolen numbers pretty much worthless.
Compare that to if the company keeps the lid on - future attackers can then feel a certain degree of safety that any "obtained" card numbers will not be barred quickly.
Just my $.02 for an idea...
/Coolgopher
I find ccdoc to be a great help. It's a JavaDoc like tool for C++.
Here's what works for me:
:) ;P )
Design:
When doing design there are a number of things I consider critical for me to be efficient.
o) Having the exact input specs available (either knowing them or being able to look them up very quickly).
o) Knowing what output is expected, what the end user will want out of this project.
o) Someone to bounce ideas off when I want to.
o) No interruptions, including meetings, newbie questions (sign on door works well for that), or incoming nerf fire.
o) When the above have been met, either
a) dark room, music loud enough to drown out the surrounding world, or
b) long walks, preferrably in average weather where I don't really notice what the weather really is like (i.e. not too sunny, not rainy, etc)
As for coding, my recipe is fairly "standard":
o) Dark room, and if really dark, turn down the brightness on the monitor as well
o) Lots of screen real estate
o) Virtual desktops. Code on #1, reference code on #2, misc stuff on #3, browser on #4 (for instant net lookups of RFCs and what not). And, of course, xmms on all
o) Hotkeyed E-term (or other transparent terminal) so that I can quickly run a couple of "intrusive" commands
o) Vi (let's not get in a fight over vi vs emacs, but I can tell you that vi runs fine (6sec startup time) on my 386. Emacs doesn't
o) Music. Normally one or two songs on infinite loop. The intro (and install) tune to the pc version of Magic the Gathering is a favorite. Only ~30 seconds long, but perfect on infinite repeat, especially when crossfaded. Other than that, techno is a good choice for me. As can Enya be. Depends on mood, although fast paced is normally most effective.
o) Phone off hook (or used for dialup access).
o) Doorbell disconnected (well, it always is anyways).
o) Huge supply of chilled Coca Cola, within reach.
o) Something to munch on (choc sultanas are good). Chips don't cut it, it gets the keyboard all greasy.
o) A comfy chair (there is a reason I spent $400US on mine!)
o) Having something interesting to code. That, would be the most important thing of all.
I think that pretty much sums it up though. Once in the zone I can stay there for 12-20 hours without a problem (unless interrupted of course).
Just because I might not like you, doesn't mean I won't respect your right to an opinion. I might disagree with everything that you say, and loudly so, but I won't deny you the right to say it.
I had exactly the same problem at my last job (which I quit partly because of exactly this).
In that job, I ended up being the jack of all trades, running around and patching things up (not so much code, but design decisions, manager awareness, team skills, etc). And even though I put in a considerable amount of effort, the project still ended up slipping the dead line by a long shot (which was waaaaay too tight in the first place).
All throughout I constantly tried to look ahead and warn the project manager of dangers and difficulties that lay ahead that could endanger the project. Only to not be taken seriously, or simply being too late for management to be able to do something about.
To me it appears that management doesn't know the software development process very well. They expect things to be easy, quick, and impactless. Documentation is required, but no real time set aside for it. Design before coding is of course mandatory, but if we get any time at all that's a real surprise (in my experience). Getting the development environment set up with daily builds, automated regression test (and integration tests where possible) is given no attention. In my last project we were four weeks into the coding before we got a semi-working development environment. Go figure.
So well, my experience is that most project managers simply lack awareness of what is involved in a software development project.
One of my goals is to get around to writing a book; "The software development process explained" (or something) targeted directly at managers to help them get an understanding of what's involved and how it all interacts. And no, it won't be a tome, I'm hoping to keeping it to 2-300 pages, so a manager doesn't feel too intimidated by it.
As a bottom note, I am now employed doing second line global technical support, and while dealing with some customers can be quite frustrating and painful, the management here has a good idea of what they are doing. It makes a world of a difference. Even though I'm more or less on call 24/7, the stress levels are nowhere near what I had in my last development position.
"Windows-- For the S&M'ers out there"
:P
I resent that comment. We use Linux and/or BSD too
If we think a bit closer about the quote:
"The limitation to this Pigeonhole Principle circumvention is that the multi-dimensional space can never be super saturated, and that all of the pigeons can not be simultaneously present at which point our multi-dimensional circumvention of the pigeonhole problem breaks down."
Bringing the multi-dimensional aspect down to a plain byte level, what they are saying is that as long as the byte only contains values between 0 and 3, they can achieve astonishing compression levels. Hell, even I could do a 64:1 with such an assumption =)
I'd say it's radio interference. On my old SoundBlaster Pro 2.0 I used to pick up Radio Moscow in my left speaker. Only the left.
(I was living in Sweden at the time, and that's not too far from Moscow).
I write my programs/utilities because I find a need for them, and there is nothing available that does what I need (or I just can't find it).
:)
I release my programs to the public because if I found a need for it, chances are that someone else does too. And why should that person have to re-do what I've already done? Sure, there are times when I will want to restrict my works and put them under a more strict licence than the GPL, but those are not the common case.
And I certainly get a kick out of getting an email from a complete stranger saying "hey, you're program is great! Thanks!", or even the old bug report "I was trying to use your program, but...". It all means that someone else found it useful, and that is a huge kick for me
Having played CAVE-Quake, having the ability to actually move around instead of having to stand still in the middle and use the "joystick" would to me seem like a very nice improvement.
:)
Someone mentioned the sound being a potential problem for the sphere, but unless you're after perfect digital AC5 surrond , I can say that it will not be a problem. The CAVE system I was using had a modest audio equipment setup, but explosions, grunts, rocket launches, etc sounded well enough for me. And the directional bit was accurate enough to locate enemies by sound as well.
The only thing is, that considering how disoriented I got after a few minutes playing, I don't want to find out how it would be inside a sphere =)
But I'm damn sure it'd be one hell of game experience! CAVE-Quake was just superb.. can't really imagine what a SPHERE-Quake would be like, except for "damn intense"
Is it just me, or was it not a trade secret that was publicly posted on /. ?
/. responsible, since at the same instance the person posted it, the trade secret ceased to exist, and therefore MS has no claims to remove it. Or possibly, they could have that copy removed, but any copies made from that one would/should be considered public knowledge and thus out of their reach.
If it was, I do believe MS can kiss that trade secret goodbye, since once exposed, it enjoys no special protections from the law, and is considered public knowledge (afaik).
However, the person who posted it is most likely responsible for copyright infringement, and can be sued.
Still, that does not hold
Do correct me if I'm wrong... these days it seems like a coder needs to be a lawyer in order to be able to write anything!
This is a most interesting idea.
What would happen if a few hundred of us publicly claimed that "I was the single one who reverse engineered CSS"? Are they going to sue as all? If we claim the sole responsibility, would it not be illegal for them to sue all of as, as only one of us could possibly be guilty?
Anyone have any idea of the possible outcomes and consequences of doing this? (read: anyone know the appropriate laws well enough?)
If this is one (legal) way to give the MPAA a headache, I'm all for it.
Alright, enough is enough.
:) )
/. gets too crowded ;) )
I want to know if there's any chance we can counter sue, on what issues, how much, where, and who can do it.
I myself am located in Sweden (that's next to Norway, fyi.), and don't have the time or legal knowledge to do something like this myself, but I will gladly support anyone who can and will do this. Is there any chance the EFF will do something like this? Or at least backing those who do sue?
I'm not talking about Norway only now, I'm talking about counter-sueing on every possible front, in as many countries as is applicable.
If they want to play rough, then so should we, on their own field, with their own methods. They may have the big money, but we have the numbers, and if every single one of us put in a few $ each, I'm convinced we could match them.
(Just look at how widespread the DeCSS source is by now
We can sit here and whine all we want while they trample us, but if we want to see some results, we should really enmass a counter strike on their own field. Answering how/who/what/where to sue is a good place to start I believe.
If there is any need for it, I'll gladly contribute with webspace and mailing list for such an issue. (In case
Cheers,
CoolGopher
PS. Those of you who haven't joined EFF yet should do so (that includes me, and I plan on doing it as soon as I get home from work today. I can't afford it, but I can afford it even less not to).