Slashdot Mirror


User: Fastolfe

Fastolfe's activity in the archive.

Stories
0
Comments
2,893
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 2,893

  1. Re:Best Security: 1st Amendment on What is Responsible Disclosure for Security Flaws? · · Score: 2, Interesting

    Its software programs will be bullet proof.

    Another thing to think about:

    100.000% reliable software costs exponentially more than 100.00% reliable software, which costs exponentially more than 100.0% reliable software. Companies cannot make a profit if they have to eat those costs, so they will have to be passed on to the purchaser.

    Given the choice between two vendors' products, that effectively do the same thing:

    1. Costs $1,000, took an extra 5 years to finish (and is thus 5 years behind the times), but is guaranteed to be "bug-free" (if there can ever be such a thing); versus

    2. Costs $50, integrates the latest technologies, but is riddled with bugs that will impact all of its users at some point, including some security vulnerabilities that will impact some percentage of its users and requires its users to install patches once a month.

    Which do you think is going to be more successful?

  2. Re:Best Security: 1st Amendment on What is Responsible Disclosure for Security Flaws? · · Score: 2, Insightful

    The best security is to inform all users once a flaw is discovered. The users can then take their flawed web clients, flawed routers, etc. off line. That action immediately prevents the problem.

    Though I suspect you intended to imply here that the "information" supplied to the users should contain a detailed description of the vulnerability, let me just point out that a vendor could just as easily send out a notice stating that a critical vulnerability was just discovered, and provide mitigation instructions.

    This certainly gives the black hats enough information to start probing the impacted service but doesn't go so far as to turn the event into a race (thereby rushing a riskier short-term patch instead of allowing the vendor to produce a well-tested one).

  3. Re:I am chinese on Blocking a Nation's IP Space · · Score: 1

    Granted, this is third hand information, but I was told that hotels catering to international guests frequently had less blocks than a typical Chinese provider. Ostensibly, this is to allow an international visitor easy access to resources from home, but it would also (if true) effectively mask the scope of the blocking that regular Chinese citizens see. But, again, I have no way to verify this, and I don't know if the source is trustworthy.

  4. Two things on What's the Point of IT Certifications? · · Score: 1

    Your immediate boss may not be the PHB that needs to see a certification. Even if you're surrounded by techies and you have a clueful boss, if you're in a larger corporation, it's the guy two or three levels up that's choosing who to keep after the company's next outsourcing push. What bits of information are going to find their way up to that person? Certifications? Certainly.

    Once you've been "surplussed", suddenly the market's saturated with techies. If you have to clear HR's scrutiny before you can get interviewed by someone clueful, what bits of information are they going to notice that your peers have and you do not? "Sure he has experience, but this other guy is CERTIFIED."

    I have no certifications, by the way, but I'm starting to eye them. I think the trick is shooting for some of the more advanced ones.

  5. Re:Let's do some maths. on Fiber Optics Bring the Sun Indoors · · Score: 1

    My office, which appears to be typical, is illuminated by banks of 3 fluorescent tubes at 32 watts each (96W per bank). Each bank appears to cover an area of approximately 96 square feet, giving us a convenient ratio of 1W per square foot.

    1000 square feet would thus be illuminated using 1kW of electrical power. We light our office 12 hours a day, 20 days a month, giving us 240kW-hour per month. We get electricity for something like US 6-8 cents per kWhr, costing us (worst case) about US$20/month ($240/year), for our hypothetical 1000 square feet.

    US$8000 / $240 = 33.3 years

    But that's just energy costs, and also assumes that the replacement lighting will be capable of lighting the same period with no energy costs of its own. In reality, a good comparison must also take into account:

    * Hardware costs of fluorescent fixtures
    * Replacement costs of fluorescent bulbs
    * Maintenance of both solutions
    * Energy costs of supplemental lighting during non-daylight hours
    * Energy costs of supplemental lighting during low-light periods (storms, clouds)

  6. DNS is not a content label on New .XXX Top Level Domain · · Score: 1

    DNS domains are intended to be organizational, not content. My organization may choose to publish 10 different types of content on its web site. We shouldn't have to register 10 different DNS domains and segregate each type of content under its own domain when we're one organization.

    We already have things like content labels in the form of PICS. Maybe Google should start supporting those types of labels first?

  7. Re:I'm not a Californian on Tinfoil Hat House · · Score: 1

    It's not just about taxes. I buy a house in a particular neighborhood not only because I like the house, but because I like living in that neighborhood. Without controls, that neighborhood could seriously deteriorate in a short amount of time. An obnoxious neighbor, or one turning his home into an eyesore, makes me want to move.

    Except I can't move now, because I owe $50k more on the house than it's worth. I can sell it, but I'll still have to make payments on it for another 10 years if I do. Sure, my taxes are a little lower, but I don't want to live there anymore, and now I can't afford to leave.

  8. Re:Outsource It on Is HTML E-mail Still Evil? · · Score: 1

    I work for a Fortune 100 company that took this approach. I would not recommend it unless you can't help it. These companies are all about presentation. Few understand things like multipart messages (as noted in earlier posts, allowing text AND HTML formatted messages in the same e-mail). Many fail to grok e-mail addresses correctly (rejecting perfectly valid but uncommon SMTP addresses as "invalid").

    In short, they work like any other consulting firm: the bare minimum to meet contractual obligations, using the cheapest labor they can find.

    If you want to have a polished presence, you'll need to find a firm that has a good technical staff, not just a firm with a bunch of coders that used to write spam software mixed with a bunch of writers and Photoshop kids to make snazzy HTML e-mails.

    Very hard to find. But if you don't have a particularly solid IT department, maybe any of these firms will do.

  9. Re:False on Private .US Registrations Disallowed by NTIA · · Score: 1

    Depends on where you live, like most things in the US.

  10. Re:Most people with privacy needs don't need a dom on Private .US Registrations Disallowed by NTIA · · Score: 1

    It's difficult to come up with a really good car/road analogy. A better (but still poor) one would be the road itself. Someone registering their own second-level domain would be akin to someone registering their own street.

    Some people want their own street name because they are a developer building new condos or businesses. There's going to be loads of paperwork associated with that, and a lot of it is going to become public information. There are good reasons for all of that.

    Other people want their own street name because they want their address to be "1 David's Way" instead of "26513 Evergreen Terrace". So they submit an application and get their driveway officially named "David's Way".

    This is obviously an abuse of the street naming system. If there is a lot of paperwork and filing information that is to become public, the government shouldn't be asked to change that policy because some people want to abuse the system.

    The policy is there for very legitimate reasons. They just happen to be inconvenient for those that are using the system for what it wasn't designed.

  11. Re:Most people with privacy needs don't need a dom on Private .US Registrations Disallowed by NTIA · · Score: 1

    This isn't a good analogy. You can use the Internet without needing your own little second-level DNS domain. You can browse the Internet, you can post content on the Internet, you can do whatever you want. If you want other people to find you or your content, you generally want some sort of DNS hostname (though you could always pass around IP addresses), but that hostname can be anywhere in the DNS hierarchy.

    Registering your own second-level domain is not needed to use or publish on the Internet. DNS is a hierarchy.

  12. Re:Most people with privacy needs don't need a dom on Private .US Registrations Disallowed by NTIA · · Score: 1

    Your situation wasn't really what I was talking about. I do exactly the same thing that you do, for exactly the same reasons.

    When I talk about people "abusing" DNS, I'm referring to people that register their own second-level domain just so they can have a shorter or trendy URL for their home page. This is using DNS domains for a content label.

    You and I are using DNS domains as intended: to reflect an administrative domain of network resources.

    These domains don't have to be second-level domains, though. We could have easily "registered" them with an ISP as a third- or fourth-level sub-domain. Whether our contact information is collected or published then becomes a matter for the provider, not the US Government or ICANN.

  13. Re:Most people with privacy needs don't need a dom on Private .US Registrations Disallowed by NTIA · · Score: 1

    So what? If I'm willing to pay money for a product for my own vanity, and someone is willing to sell it, that's what commerce is all about. Should I not be allowed to anonymously purchase a mirror at the store for my purposes of vanity?

    A DNS domain is intended to represent an administrative domain for network resources. A consequence of registering a domain for that purpose is that you should have published contact information.

    What you're doing is registering a DNS domain for a purpose other than what it was designed for. That doesn't exempt you from adhering to the requirements of a domain registration.

    Says who? All Internet users connect our infrastructure to the Internet every single time we access the Internet, which is 24/7 for a big chunk of the public. That doesn't mean that everyone connecting to the Internet should be identifiable.

    I agree. But when you set up shop on the Internet by declaring that you need your own second-level DNS domain, there are other obligations that go with that privilege.

    When you merely "connect" to the Internet, or publish content on some web server somewhere, there's nothing requiring you to register your own second-level DNS domain for that. When you dial up to an ISP, your system is connected to the Internet using a hostname beneath your ISP's DNS domain. When you publish content through your ISP's or web provider's servers, that content doesn't necessarily have to reside directly beneath some vanity DNS domain. DNS is a hierarchy.

    So what? Just because there are alternative mediums doesn't make it okay.

    Since there is no technical reason the domain is needed in these cases, people should not expect any sort of constitutional protection. People are still free to publish content elsewhere in the DNS hierarchy, or without using DNS at all. You can have an Internet presence without needing to pretend via DNS that you actually have Internet infrastructure, which is what a DNS domain is intended to reflect (and why these rules exist). Just because you want to abuse DNS doesn't mean that the rules should be changed to suit you.

  14. Re:Constitutional right to privacy on Private .US Registrations Disallowed by NTIA · · Score: 1

    It's not abuse of the domain name that I care about, it's abuse of the network. Maybe a host under your domain is causing problems. Maybe a host on your network is compromised and I want to let you know. Maybe someone has defaced your web site.

    I still like the analogy because when you register a DNS domain, you are effectively stating that you are declaring an administrative domain that is subject to no other administrative domain, and that you intend to place Internet hosts within that administrative domain. If that isn't what you're doing when you're registering a domain name (which is increasingly common, as DNS is treated as a content label or an identifier for a web page), you're actually abusing DNS. When you use something for a purpose it wasn't designed for, you frequently discover that there are side effects. This is one such side effect.

  15. Re:Constitutional right to privacy on Private .US Registrations Disallowed by NTIA · · Score: 4, Insightful

    When you buy land, or register a name for your business, you have to provide certain details about yourself to your local government, which becomes public information.

    Why is this any different? Why does a "constitutional right to privacy" not apply to these situations, but should apply to someone registering a DNS domain? A DNS domain is intended to reflect an administrative domain over Internet infrastructure. We need published contact information if you intend on connecting infrastructure to the Internet when that infrastructure is significant enough to warrant its own second-level DNS domain. If you intend to (ab)use a DNS domain as a content label for your Interweb content, you need to be aware of what the DNS domain is intended to represent, and be prepared to abide by the requirements that result from that even though you aren't using your DNS domain for what it was designed.

    It's like me going downtown and buying a lot of land just so that I can post some signs carrying some anti-government statements, and then balking because the evil government wants me to identify myself as the owner of that parcel of land. I don't have to own that land in order to exercise my right to free speech. You don't have to own your own little DNS domain in order to have a web outlet for your content.

  16. Re:My take on it... on Private .US Registrations Disallowed by NTIA · · Score: 1

    I agree.. the only issue with that approach is that it requires the intermediary to act as a proxy and to use their own judgment before allowing your message through, or in providing their client's contact information.

    Further, if you have some form of network emergency and need to contact the domain holder immediately, you're not just limited by the availability (business hours?) of the domain holder, but by the availability (business hours) of all of the proxies in between.

    In short, just having contact information of an intermediary isn't enough if the intermediary isn't available (even if the domain holder is), or if the intermediary unilaterally decides not to pass your message on or decides to sit on it for a few days.

    If you own a DNS domain, then you probably own some sort of infrastructure connected to the Internet. If that infrastructure starts causing problems for others on the Internet, you need a way to contact the owner ASAP. This means valid, published, contact information.

    If the only reason you want a domain is for a trendy vanity DNS label for your web content, that's not what DNS was designed for, and so long as you continue down that path, you're going to run into issues like this, where requirements target infrastructure owners, not content owners.

  17. Re:Here's what I put into the petition. on Private .US Registrations Disallowed by NTIA · · Score: 1

    the thought that my personal information would be freely available to any person connected to the internet is scary.

    The only reason this information would be available is if you have registered a DNS domain for infrastructure that you are connecting to the Internet. If you are not connecting infrastructure to the Internet, you should not need a DNS domain.

    If you want to publish web content anonymously, get in touch with any of the hundreds of web providers out there that will host your content on their own servers (on their own DNS domain). DNS registration will reflect their identity. They will divulge your identity to others only as allowed by their privacy policy.

    DNS domains are intended to be administrative domains for Internet infrastructure, not as a content label or key for accessing web content. Nevermind that DNS is being used as a content label/key. This very issue stems from the fact that it wasn't designed to work that way. If we want to continue warping DNS's purpose like this, we have to deal with issues such as this one.

  18. Re:bollocks on Private .US Registrations Disallowed by NTIA · · Score: 1

    Fortunately the US legal system has already thought of that. You can file suit against someone without knowing their identity. In the course of discovery for the suit, you can subpoena things like billing records to identify the person. You then amend the complaint with the actual name. Happens all the time, and works well.

  19. Most people with privacy needs don't need a domain on Private .US Registrations Disallowed by NTIA · · Score: 1, Informative

    Typically, the only reason individuals want their own second-level DNS domain is vanity. They want a cool, short hostname so that their URLs are trendy. This is not a barrier to your freedom of speech because there are hundreds of free web providers out there who would be glad to post your web pages on the Intarweb without needing to put them on their own domain.

    Like it or not, the purpose of a DNS domain is to identify a namespace for hosts under your control. In short, a DNS domain reflects Internet infrastructure, not some vanity content label. If you're going to connect infrastructure to the Internet, you should be prepared to announce your identity to the rest of the Internet so that if/when you cause problems, you can be contacted.

    If you don't want to connect infrastructure to the Internet, and just want an outlet for your speech, again, there are plenty of ways to do that that don't involve your own little DNS domain. Because of that, you should have no expectation that the US constitution somehow "guarantees" your right to privacy here, or that you have some sort of "freedom of speech" claim that should allow you to keep your registration private.

  20. Re:This isn't that serious on The Return Of The Pop-Up Ad · · Score: 1

    Exactly.. this is the way to approach things. Code as though you don't know what JavaScript is. Give users submit buttons, have your links load actual pages, etc. Then if you feel you want to make it behave a little differently, layer JavaScript onto that. Manipulate the DOM, hide things, display things, use event hooks like onclick to override link anchors, etc.

    Put a small amount of thought into it, and you CAN have a web site that does not REQUIRE javascript.

  21. Re:Related question then... on The Return Of The Pop-Up Ad · · Score: 1

    I've passed Unicode through the URI query string before without incident.

    The trick is understanding that URIs are sequences of bytes, not characters. The convention is to use UTF-8 to encode the URI. Don't try to just write out http://example.com/ followed by some Unicode characters in your URI. That would be an invalid URI. The characters have to be encoded into UTF-8 and the resulting bytes URI-escaped.

  22. Re:It depends. on Who Owns Weblog Content? · · Score: 1

    State laws vary from state to state.

    I have heard of cases (horror stories) of employers successfully asserting ownership of things that an employee did entirely on personal time, entirely using personal resources, doing something that was not related to his job. It all depends on what's in your contract (as I noted previously), subject to the laws of your region (as you note).

  23. Re:SEOs Overrated? on Climbing up the Search Ladder · · Score: 3, Insightful

    The company I work for did the SEO thing. The SEO vendor provided us with a few dozen static HTML files that we were to drop into our web server's document root alongside our normal content. Obscure links to these "optimized" pages would seed the search engines.

    When I went through the static HTML documents they produced, it occurred to me that they looked an awful lot like a real web site with actual content. Our web site is one of those brochure type sites: lots of expensive graphic design and layout, little actual marked up content.

    The lesson: Build a real web site following good information design principles, make it readable to search engines, and then style it to make it look like the glossy brochure you seem to want instead. Use a healthy dose of hyperlinks to product descriptions as needed to ensure the right pages get the right focus, and you're set.

    SEO appears to some executives as some magic computer voodoo designed to trick search engines into going for your content first. While that's partially accurate, the biggest impact on search engine listings is actually having useful content. Enough with the flashy text-in-graphics web sites and start writing pages with text-in-markup, and the search engines will notice.

  24. Re:It depends. on Who Owns Weblog Content? · · Score: 1

    Further, all of this depends on what the employment contract looks like. There are likely clauses within it that may allow the company to claim ownership of content described by one or both of your last two statements.

  25. Re:I hate college on Defining Google · · Score: 1

    I agree, but I have a bit of a counter-example that you may find interesting. (I have no college degree.)

    I signed on with a contracting firm that had no degree requirements. They placed me with a large telecommunications company in a development/admin position. This company has a policy of only hiring those with college degrees. However, after seeing the quality of my work, my boss was able to get me in anyway (apparently without too much difficulty).

    When I was ultimately hired on, it was (as expected) at the bottom rung of the corporate ladder. Within a few years, I saw plenty of new hires being brought in one or two levels above this with far less experience (and aptitude) than I possessed. While at first I was annoyed that these folks were coming in making more than I was, and I was doing twice the work/quality, after a few years of salary increases, things evened out as I expected.

    So don't give up quite yet. Lots of companies say they "require" college degrees, but if you can demonstrate that you have the skills, you can frequently find your way around that. The HR people coming up with these position listings think having a degree is everything. Technical managers actually responsible for getting people hired usually know better.

    Getting "in" another way (perhaps in a consulting firm like I did) could also be very helpful.