Slashdot Mirror


User: asdf7890

asdf7890's activity in the archive.

Stories
0
Comments
1,126
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 1,126

  1. Re:Oh, this sounds like a good idea... on Should Auditors Be Liable For Certifications? · · Score: 2, Insightful

    If they win this lawsuit, they're setting a dangerous precedent - anyone who at any stage has certified a system as secure becomes responsible for its ongoing security, and can potentially be held liable for stupid user errors by users of that system.

    IMO it depends on where the fault lies.

    If the fault that allowed the problem is a property of the system that an auditor or penetration tester could be reasonably expected to have picked up on (such as password complexity and cycling rules not being present or not being correctly enforced) then maybe the case is valid.

    If on the other hand the problem is outside the system that was audited (i.e. the breach was due to a user having stored/transmitted a copy of their credentials insecurely, or due to users/admins not being adequately trained, or due (or due in part) to software/configuration/network changes made after the audit was complete) then there is no way the auditor should be held responsible.

    In reality all that will happen which-ever way this case goes is that there will be chunks of new boiler-plate exceptions text in future relevant contracts or the auditors will charge companies more in exchange for underwriting the extra risk. At work we are currently playing piggy-in-the-middle with the agreements for penetrations testing a new system we are building for a client and there is a lot of contracts work that goes on sorting out who is allowed to do what and who (us, the DC and equipment provider, the client and the 3rd party testers) is responsible for what now and going forward - this case will do no more in the long run than to add extra items to those lists (an increase the relevant consultation fees too, of course).

  2. Re:More than enough time... on Microsoft Confirms October 22 Release Date For Windows 7 · · Score: 1

    (...) so I wouldn't hold your breath.

    I would imagine it's very difficult to hold someone else's breath.

    I find a good pillow and the element of surprise work wonders.

  3. Re:More than enough time... on Microsoft Confirms October 22 Release Date For Windows 7 · · Score: 1

    Any suggestions on a good 5.1 card?

    In recent years (since a Creative card refused to work with any driver I tried after I'd upgraded my main desktop machine to XP in ~2005) I've been using the on-board sound support on motherboards and finding it good enough for my not-very-good ears not to care about the difference.

  4. Re:Resume? on What Do You Do With a Personal Domain? · · Score: 1

    Perhaps he doesn't want anyone who knows his name to be able to see the details of his life..

    Fair point, but you could put a sanitised version there with relatively "anonymised" contact details (a can throw-away-and-replace-if-it-starts-getting-spam email address, or some sort of mailform (though good luck stopping bots bothering you in either case). Just a list any major projects that you have worked on, that you are permitted to talk about, with links where relevant, would be useful if a prospective future employer decides to Google you. Much better that they find that than just some junk people you barely know have said about you on their blog or social network profile.

    My personal domain hasn't been updated in years, but as I draw close to the end of a particular personal-time project I plan to update it with the following:

    • an improved look, more-or-less mirroring the above project (nothing fancy, just less slap-dash then the current page)
    • links to the new project, and older stuff that is already out there (with links from the other stuff back to the new stuff too, where relevant)
    • links to stuff by friends and family that someone who gives a shit enough to look me up might be interested in
    • brief information about me - enough for someone searching to know that it is me they have found and not someone else of the same name and enough for them to get a little bit of a picture of the parts of my personality I am happy for the general public to know about
    • an index of some of my notes (speeding up FireFox on netbooks, my backup techniques+scripts for the netbook and such) that I think people might find useful - these I will link to in my sigs on relevant forums (so people who might find the pages useful, and might click further to look at the projects that might one day make me a little pocket money
    • some of the personal time "projects" I've never published previously (except amongst friends and collogues), with a little documentation - some of which (things like "tinkering with arbitrary precision math in JS and using it for performance tests for modern JS engines by implementing simple DH key exchange") might garner general interest and therefore draw attention from people who could pass on tips improve them
    • and so on

    If you have something you want to draw attention to, or you just want to learn/practise something new in terms of page/application design, then making something of your vanity domain is a place to start. If you don't, then just don't bother. Seriously - unless there is something to gain (and I'm not discounting the unsubstantial gains here - fun, learning and simply "passing time in a more brain engaging way then watching TV" are perfectly valid gains in this context) you might find it personally more satisfying in the long to to instead find something else to do with your time (reading a book, for instance).

    My intended gains from my personal domain are getting my name associated with useful sounding things (currently the only "me"s that turn up in Google are nothing like myself), collecting my projects and notes together in a form that might be useful to me and certain contacts, and drawing a little attention to things I might like to draw public attention to.

    Of course I've been going to do something like this on and off for ages now and have yet to get around to it, so it may never actually happen at all!

  5. Re:More than enough time... on Microsoft Confirms October 22 Release Date For Windows 7 · · Score: 3, Insightful

    ...for Creative Labs to get on the ball and release 64bit audio drivers for the X-Fi series that don't cause constant crackling and odd behavior. I swear, past their XP drivers, the drivers for Vista and Win7 are horrid. Least I got a USB headset that works well. The rest of my Win7 RC test machine works wonderfully though, save for the sound, which is driving me insane.

    I'm told (2nd hand anecdotal evidence: I've not used a Creative sound card in some time) that Creative have been somewhat lacking in the quality driver department for some time, so I wouldn't hold your breath.

    If you are having trouble with their Vista drivers after all this time what makes you thing they'll get good quality Win7 drivers released in the next six months?

  6. Re:Retaliation on Twitter, Flickr, Hotmail, Others Blocked In China · · Score: 1

    You may be tempted to do what many other people are already doing but remember that language barrier aside, you're blocking your website from 1/6th of the Earth's population.

    How many people in China actually have reasonable access to the Internet? Not a large percentage I'd say given the vast economics gulf that exists between the "top" few levels of the society and the rest. Saying that blocking China is blocking a billion people is daft for that reason alone.

    Also, how many people in China will care? I know the original comment was in jest but your response didn't seem to be, but I really don't see what interest my current sites would hold for your average "Internet capable" resident of China and that is before considering any language barrier, so I'd not be blocking anybody who cares about the content (but may be blocking many hack attempts, though contrary to what some sites seem to see my logs suggest that I get a lot more from elsewhere than I do from China). Though you could put that the other way: what would blocking them achieve given that none of them are likely to care anyway?!

    Anyway: if you want to ban China from your site for what-ever reason, I don't recommend going through the hassle of setting up IP block lists that your firewall/server will have to work to enforce and that you will need to work on to test and keep up-to-date. Instead simply mention the events of 20 years ago in a certain square and China will do all the work of restricting access to your services for you!

  7. Re:The Best Thing To Do on Triangular Buttons Make On-Screen Keyboards More Usable · · Score: 1

    Is to get rid of the damned, usless, pain in the ass keycaps key.

    If you are a Windows user, try pitaschio from http://pitaschio.ara3.net/ - disabling caps lock is one of its many features (all of which can be turned off and/or tweaked if you don't like them).

    There are ways to do the same thing under Linux, most of which involve playing with xmodmap. If you use Ubuntu (and presumably anything else gnome based, though I'm not 100% on that as I've not used desktop Linux for years until my recent netbook acquisition) the the GUI keyboard control panel its your friend. There isn't a "just disable the damn thing" setting but if you look in the "ctrl key position" options there is "make capslock an additional ctrl key".

  8. Re:Summary on Tetris Turns 25 · · Score: 1

    And sad story too, how the inventor of the game got almost nothing out of it!

    Aye. Though he did end up doing well enough in the end (not as well as he could have done when you consider how much various companies made, but he certainly seems comfortable be all accounts).

  9. Re:Summary on Tetris Turns 25 · · Score: 3, Informative

    Uh, to be fair, it was really the British and the Hungarians that began the ruination of Pajitnov's rights

    It was far more complex than that. The BBC did an interesting documentary about the history and rights issues of the game a few years back (around the 20th anniversary IIRC). They got fairly frank interviews with people involved at the time (including the man himself, some of the developers and business people who were fighting for the publishing rights, and the Russian civil servant whose job it was to play all the suiters off each other). Well worth a watch.

    Search for "tetris from russia with love" - if you can't find it to purchase/rent/stream legitimately I'm sure you'll find a copy on your preferred alternative online TV source...

  10. Re:Hoping for... on Monkey Island To Return · · Score: 1

    My inner nostalgia freak wants a HD remake of Day of the Tentacle. I'd enjoy replaying it, without the distraction of the creaky old graphics.

    I replayed DOTT a while ago and I can't say the graphics were a problem at all. In fact I'd go as far as saying that they were part of the "charm".

    I might have to get SCUMMVM installed on my netbook and shovel a copy over for the train journeys over the coming months (or I might just read a book...).

    Plus I like the idea that a new generation could experience its joys.

    Aye, the new generation might not put up with low-res cell-animated-cartoon-style graphics. But they are too busy mussin' up my lawn to care anyway...

  11. Re:Back to the Future? on When VMware Performance Fails, Try BSD Jails · · Score: 3, Informative

    Don't forget, depending on the type of windows licenses you have, if it is per-processor based, this means I can run all 10 of my VMs on only 2 lic's from Microsoft. (Because each VM only uses 1 of the 2 cores). Getting 8 "free" Windows 2003 server lic's is a pretty damn good deal.

    Erm, I'm pretty sure it doesn't work like that - I recommend that you go find and analyze the small-print to make sure you are covered in case someone comes round to audit!

    My understanding is that each virtual CPU that Windows runs on would be considered a CPU for Windows licensing terms so if you have 2 1-to-2-CPU Win2K3 licenses then you are licensed to run Windows 2K3 in two VMs and no more (or use one license on the host and one in a VM). If you run 10 VMs each with Windows as the OS then you need 10 Windows licenses (if you buy each separately) or at least 10 CPU license (if you use some sort of bulk purchase arrangement for per-CPU lics).

    Also, the "1 or 2 CPU" term in a lot of MS licenses only covers one or two CPUs in the same machine, not running with the same license on two separate single CPU machines (physical or virtual). They don't count cores (just physical CPU packages) so you would be OK with a "1-2 CPU" license on a machine with two quad-core CPUs, but I don't know how this extends to VMs (they are likely to see 4 vCPUs in a VM as 4 CPUs not 4 cores on one CPU, irrespective of what arrangement of physical CPUs/cores the host machine has).

    It is a while since I reviewed the licensing terms for Retail/OEM Windows Server releases (at work we are a small MS dev shop, but our Windows servers and desktops came with there own lics where needed (or run Linux in the case of file servers and VMWare host machines) and the OS installations and those we use (on physical boxes or VMs) for testing are "licensed" via our MSDN subs), so I could be wrong here. But I don't think I am...

  12. Re:UML FTW! on When VMware Performance Fails, Try BSD Jails · · Score: 1

    Or there's always User-Mode Linux.

    Good though UML is for some things (particularly its original reason for being created: certain driver/module development and testing work) I wouldn't bring it into a discussion about performance.

    While I've seen reports that show UML can beat VMWare-on-a-host-OS arrangements (i.e. the Player and Server products) in some benchmarks where almost all the benchmark is in userspace (i.e. almost no system calls) the performance hit of a system call can quickly bog down most real world VMs. As one anecdotal data point: testing a Zimbra server in a UML VM resulted in much slowness including parts of the admin interface (not always fast at the best of times) being practically unusable, but the same installation in a VMWare VM (using the same set of test data (migrated from one VM to the other) to improve the fairness of the test) was significantly more responsive on the same host hardware+OS despite haivng less RAM allocated (so the VMWare guest OS ended up swapping a little where the UML one didn't). I saw similar results when moving a simple web server (originally a copy of a VM run on linode.com back when they ran on UML not Xen as they do now) from UML to VMWare.

    UML has advantages in specific cases and was the best inexpensive option for a time if chroot wasn't right for your needs, but I wouldn't recommend it generally now considering the quality of current freely (and in some cases Freely) available alternatives.

  13. Re:Uhm... but this is old news, isn't it? on Microsoft Update Quietly Installs Firefox Extension · · Score: 1

    Someone should tell this to Adobe too - installing Reader 9 installs AIR and Acrobat.com with no way to disable it, unless you use some switches on the command line.

    I just tell people to install a different PDF viewer unless they need something specific that only AR supports (or that AR supports better than the alternatives).

    This isn't going to work for the .Net environment though as there are not complete viable alternatives and enough software out there that is build on the framework that "just find other applications that don't use it" is no more practical than telling people to move away from Windows completely (OK so that is often practical, but you try convincing many people of that!).

  14. Re:Uhm... but this is old news, isn't it? on Microsoft Update Quietly Installs Firefox Extension · · Score: 2, Interesting

    The .net-Update has "installed" this Add-On secretly for a few months now, as far as I know. It just got into the "normal" Windows auto-update stream, thus annoying more and more people? Or am I somehow mistaken?

    It has certainly been around for some time, and I think it has been in updates that Joe Public gets automatically for a while too. My guess is that this reported has only just heard about it so to him (and presumably other too) is it new news.

    At first it turned up as part of the Visual Studio install/servicepack, so developers got it first, I'm not sure when I first noticed it appearing on machines that had the relevant .Net libraries but no VS.

    I don't have a problem with the add-in existing, or it being installed by default. But being installed by default with no opt-out and with the uninstall/disable options removed from the user, is either bad customer care or plain malice (though for all the noise my inner tin-foil-hat is making I can't think of anything logical that such malice would achieve for MS, so "not caring about the customer" is the more likely option).

  15. Re:Elucidarian on Facebook Reunites Mother With Long-Lost Son · · Score: 1

    Aye. I wonder if it was a genuine mistake on the BBCs part (if the people being interviewed said "facebook" because they don't know the difference (or the difference is inconsequential to them) would the reporter know to check/correct?) or a deliberate preference towards no mentioning any of Rupert Murdoch's empire in a good light?! (for those that don't know: Mr Murdoch has been generally critical of the BBC in a number of speeches/interviews in recent years)

  16. Re:URL? on Facebook Reunites Mother With Long-Lost Son · · Score: 1

    It was covered on the BBC: http://news.bbc.co.uk/1/hi/england/dorset/8072914.stm

    The story was no doubt other news outlets too but the Beeb is generally my second source, after http://newsarse.com/

  17. Re:As an iPhone game developer... on On the Expectation of Value From Inexpensive Games · · Score: 1

    Is $0.99 for a few hours of fun expensive?

    Don't waste your time worrying about these people. This sort want everything, twice, yesterday, and they think that you should pay them for the privilege of their attention. No price decrease/increase or change in experience length will change that, you'll never achieve their target value for money of "infinity for nothing".

    Of course one major problem with not worrying about people like this, is that such spoilt little children seem to be the majority these days... (or, at very least, a very very vocal minority)

  18. Re:Which backup program on Burglar Nabbed By Backup Program · · Score: 2, Informative

    Cygwin does crontabs very nicely to do all sorts of Unixy things. It's a fantastic way to make a Windows box halfway sanely usable. Particularly if you set up sshd.

    Seconded. rsync+ssh is great for backups either directly on Unix-a-like systems or via the CygWin distribution on Windows. Setup is a bit manual of course, but if you have the time you can use the tools to create a very flexible and reliable setup.

  19. Re:Hit back. on Asus Slaps Linux In the Face · · Score: 1

    Thanks for the link. I too shall not purchase an Asus netbook and will stop recommending them to people (actually the netbook I currently carry is an Acer anyway: while at the moment the Eee range is the better VFM proposition if your budget is above a certain price, but below that price Acer models win for what I and people I know need/want). If Asus are openly saying that their kit is no good for Linux then I will not purchase any of their kit.

    This will go as far as other hardware too (IIRC the GFX card in my main desktop machine has their badge on it, as has the motherboard in my little server). If they are willing to give preferential treatment to Windows on one range, what it to say they will not do the same for graphics cards and motherboards? I wouldn't want to be in a situation like the one hit by Linux users of Foxconn motherboards a while back. There are a number of other manufactures of such parts out there so I'm not harming myself at all by not considering any Asus products for future purchases.

  20. Hit back. on Asus Slaps Linux In the Face · · Score: 1

    Ignoring for a moment the fact that there is probably no direct link from this site to either Asus or MS, as pointed out by many above, and that the site is presumably by some low-on-work designer trying to get attention...

    If any company were to publish a site like this the community or another manufacturer could easily hit back with a similar "Linux works better on XYZ than it does ABC - look, even the people who make ABC say their hardware doesn't support anything but Windows properly!". OK so many won't care directly because they want Windows irrespective, but such a site could make a link between hardware not working well under all OSs to quality issues (it works fine on our hardware, I wonder what is wrong with theirs?) or lack of future proofing (will they make a version of proprietary custom driver X for future versions of Windows?)

    The above is just one reason that a company like Asus would not support a site like this one - it could too easily back fire and lose sales. It would also open them to litigation in some territories with people who bought one without Windows before such a "Linux won't work as well" campaign being able to claim that their version with Linux was mis-sold to them as the manufacturer now admits the arrangement is not adequate.

  21. Re:Forget Heads... on SATA 3.0 Release Paves the Way To 6Gb/sec Devices · · Score: 2, Informative

    Did I miss the memo that says flash no longer has a limit on how many times it can be written upon?

    No, but the limits are sufficiently high with current technology revisions that it isn't really a problem.

    For good solid state drives in all but the most convoluted use cases the expected average time before failure is of about the same order, or some claim better than, spinning disk bases drives. I emphasize the word "good" in that last sentence as this probably may not extent to cheap USB sticks that could be using old design memory and controllers and are generally subject to hasher physical conditions then an internal drive (even in a laptop/netbook).

    They key issues with solid state drives at the moment are relative cost (though this will change as the tech matures further), write speed for many small writes (though better drives are coming with more intelligent controllers now, that mitigate this issue somewhat), and write speeds in general particularly after some use (but again, this issue is being actively worked on).

    Unless you have a specific use that you think will punish individual flash cells, the write limits should not be a concern when comparing SSDs to spinning disks - instead pick the technology that best fits your desired I/O, power use and noise profiles in your price range.

  22. Re:Why? on Netbook-Run Dice Robot Can Rack Up 1.3 Million Rolls a Day · · Score: 1

    But even if your initial source is truly random, you detector may introduce some form of bias through sampling error or the process of turning an analogue readings (i.e. the time between two emissions from your radioactive source) into discrete values, so your generator it not likely to be perfectly random even if its source is.

  23. Re:Why? on Netbook-Run Dice Robot Can Rack Up 1.3 Million Rolls a Day · · Score: 2, Insightful

    Why would you need this? And how is this better than a RNG?

    Erm, it is an RNG. A proper one at that, not a PRNG.

    OK so there might be a little bias somewhere in the system (a slight manufacturing defect in some of the dice making the chance of getting a six 1 in 5.99999999 instead of 1 in 6, or perhaps some oddity in the optical processing code that makes it fail to recognise the colour representing four more often that it fails to recognise threes) but only a perfect RNG would not have a little bias like this and there is no such thing as a completely perfect RNG. There are statistical analysis and filtering techniques designed to detect and filter/reduce such bias in systems.

    And on the subject of "why would you need something like this?": sometimes wanting something is enough. Sometimes the fun of creating something and the joy of a successful project completed are the whole point.

  24. Re:Meh? on Where To Buy A Machine With Linux Pre-Installed · · Score: 1

    If that were true, we should be seeing the same number of returns for the low-end Windows system.
    The box that can't play the game of the moment either.
    When the buyer wants games - you give him games - or you drop out of that segment of the market.

    There are two points there

    1. Perhaps games were not the right example to choose - they certainly are not the only example. What about someone who needs to view/edit MSOffice documents so full of VBA scripts that nothing but office will ever cooperate? What about little Johnny's favourite flash games being inaccessible because the sites hosting them have a brain-dead design that only works in IE or requires a later version of Flash than has been ported to Linux yet? Windows only personal finance applications?
    2. I also suspect (call me cyncal if you will) that a lot of the returns of this nature are only using incompatibility as an excuse. "You didn't tell me this would not work with Photoshop and I'm sure I mentioned that I wanted to use it for graphics work" hold at least a little more water than "I have buyer's remorse and wish to have a refund" or "I've seen something better/cheaper/both and would like a refund". Call me cynical if you will...
  25. Re:Meh? on Where To Buy A Machine With Linux Pre-Installed · · Score: 1

    and not to mention, they(acer and asus to a lesser extent) put a linux distro that no one has ever heard of and has no documentation on their computers, obviously everyone is going to use a computer that no one knows how to do anything on

    That is improving a bit with some netbooks (at least one from Toshiba, and some others that I forget) coming with Ubuntu so they are coming with a distribution that is well known and has at least some pre-existing support network.

    It is said that Acer went with Linpus mainly because of its relatively good support for various eastern languages at the time they were making the decision (I'm not sure how well other distributions match up on that factor in their more recent versions) so it may not have been an optimal choice for our part of the market to was for Acer's target audience on the whole. Another advantage Linpus has over UNR is the first-boot-to-useful-application-interaction time which is noticeably lower then I've been able to tweak UNR to manage - probably lower than UNR will every manage out of the box if only because Acer's custom Linpus setup doesn't have to scan for such a wide variety of hardware it might need to support.