Slashdot Mirror


User: baur

baur's activity in the archive.

Stories
0
Comments
27
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 27

  1. Re:One reason I quit fixing Windows on New Worm Installs Sniffer · · Score: 1

    That's funny, because remember that exploit Apple had a few months back: the one where you click a disk image and it automatically ran?

    We have only 4 Mac users, and 2 of them clicked disk images on the net. *2 of them*. Half of the staff. Both got weird variants of a program that basically hosed their Applications directory.


    Wow... I'm impressed. I went looking for versions of that exploit and couldn't find anything except a test version that proved the existance of the hole but didn't do anything.

  2. Re:No word? on Apple Addresses URI Handler Issues · · Score: 2, Insightful

    Yet another Excluded Middle fallacy

    You know, you keep saying that, but it sounds like you are doing the same thing. You seem to be claiming that no "typical" users are smart enough to figure out what's going on. There are not just smart and dumb users, there is a range. Designing things like this means striking a balanace between security and convience. There are no hard-and-fast rules about it.

    The main reason I responded though was just to complain about your analogy. It doesn't fit. The remote exploit that this is all about is not completely automatic. It requires the user to browse the internet to a malicious site. Your example describes a more dangerous situation where a users machine is at risk randomly and needs to only be connected for it to happen.

    My only reason for mentioning this is that, since the user is already activly involved in the process, its not a great leap to have some instructions on the site like: "A new volume should show up on your computer, please double click the file in there to see the cool cartoon."

    I know what you're going to say, this is an "Excluded Middle Fallacy." No more than what you've proposed. What I'm trying to say (and I suspect a few others) is that you have to trust the user to do the right thing *at some point* - although I'll grant its debatable at what point that occurs. There is some anecdotal evidence that dialogs are not always read and understood, but this still turns an automated exploit into one that requires an extra step of user interaction. This is not a dialog that users will see frequently, and so it isn't one that they will become jaded by. I understand your position, but - for me - it restricts features a little too much. There are cases where you would want to say "Ok" to this dialog (like a help:// tag, for example - I would be very annoyed if I had to go an find the help app just to launch it once before it could be used). There are other situations as well.

    As I've said many times: DO NOT register apps until they are first explicitly launched.

    This sounds good on the surface, but think about it - do you want to have to explicity lauch every helper app before it gets used automatically? (Although its not quite true, let's assume this afects pre-installed apps as well.) Want to unstuff and app? Sorry, you need to hand launch Stuffit Expander once first. Want to use the Citrix client to connect to a remote server? Sorry, gotta launch the client once (never mind that it makes no sense to do so without a connection file).

    I don't want to deal with that, because I don't like my computer getting in the way of what I'm doing - and I don't feel that its a great compromise of security to have a dialog box appear (although I do think the default should be cancel).

  3. Re:Usability Growing Pains on Apple Addresses URI Handler Issues · · Score: 2, Interesting

    I think they've done a decent job of avoiding knee-jerk reactions on this one. The way it's designed, the dialog will very rarely come up, so the user will (hopefully) not become jaded as to its meaning. When it does appear, it should seem out of the ordinary, causing most reasonable people to at least give it a quick read.

    Does this solve the problem completely? Of course not, but this is a fairly good solution that covers most cases, makes the majority of people more secure and doesn't keep me from using my computer the way I want to.

  4. Re:No word? on Apple Addresses URI Handler Issues · · Score: 5, Insightful

    You think much more highly of the average user than I do.

    If you have that low an opinion of people, then you should realize that there is almost nothing that can be done to protect them. At some point, a user has to be allowed to run programes - and new ones at that. If not, then the computer is nearly useless.

    Social engineering is always possible. Heck, there are windows viruses that spread using a password protected zip file. That means that the user has to be convinced to download the file, open it, put in a password and then run the trojan. Sure, some people are dumb enough to go through all of that (the fact that its spreading at all is proof of that) - but how many hoops are reasonable to jump though to protect the user? At some point, the OS has to step back and let the user do what they want, or else they'll go use something that gives them more control.

  5. Re:XP and OS X difference on Making Operating Systems Faster · · Score: 1

    Off topic: I've been wondering about battery swaps for awhile. So, it *is* possible to swap a battery while a machine is asleep? How does that work (ie: where does the machine get its power for the 10 or 15 seconds that you're messing with it)?

    I've been thinking about getting a second battery for long trips, but thought it would be annoying to shutdown and restart to change them out.

  6. Re:Cart before the horse in the 80's on US Losing its Scientific Dominance · · Score: 1

    But the real sin to our society is the smart, poor kid who can't afford the education while an academically mediocre rich kid can, and gets the associated opportunities.

    Not true. There are plenty of "poor" people in college - that's what financial aid is for. Sure, you end up masivly in debt, but Educational debt is one of the easier loans to deal with (if you can't get grants).
    Sure, its easier to go to college if you're the son/daughter of a rich family - but its easier to put food on the table and to get a car as well. Just because colleges cost money doesn't mean that its a rich boy's club. Besides, the cost of higher education is all across the map.

    BTW, I agree with most of what you said, but I think that line was an oversimplification of what's out there. To me, there's more sin in the fact that a lot of employers are asking for a degree to filter the resumes when the job doesn't actually require it. That practice marginalizes education. I know people who got a degree just to put it on paper - not because they actually cared about (or needed) the info that was taught.

  7. Re:Unfortunately, Apple is too bullheaded... on BusinessWeek on Opening Apple's iTunes DRM · · Score: 4, Interesting

    they pay Apple a license fee

    This is no longer true. There used to be a $0.50 per-port charge for using the name FireWire - which is why you see IEEE 1394 all the time instead. A couple years ago, Apple dropped the fee. Unfortunatly, I think the 1394 name is probably going to stick at this point. (Sony calls it iLink, I think, but its still the same thing.)

  8. Re:Low (?) level magnetic fields on Electric Shavers Rot Your Brain · · Score: 1

    There have long been known (or claimed) issues with that

    You almost have it right... "claimed" issues, not "known" issues. There have been plenty of Dateline / 48 Hours / whatever stories about schools and/or neighborhoods near powerlines that have a high rate of cancer, but there have been few honest studies that showed a causal link. The thing people forget is that for the one or two places like that, there are *thousands* of places near powerlines that have average - or even below average - rates for cancer. I've never seen a story about power lines being healthy, but I'll bet you could find an area with power lines where all the residents happen to be very healthy compared to the population at large.

    There have been a number of studies (even long term ones) looking for EMF as a cause of cancer and - to my knowledge - none have found a link.

  9. Re:Some people simply don't get it on Why iPod Mini is a smart move for Apple · · Score: 2, Interesting
    The human mind is very good at remembering lots of things - especially when given some context. For example, I "know" the words to almost all of a Queenryche's older albums (6 that I'm thinking of - that's around 60 songs total, more... actually). I can't recite the words, but start playing the music and I can sing along.

    Anyway, about the Do you suppose you have you in your entire lifetime heard a thousand different songs that you could hum a few bars of now? Well, sort of. Using the above to judge (ie: I might not be able to hum it on cue, but start playing the song and I'll remember quite a lot of it), lets look at some breif numbers.

    I have (approx.) 300 CDs

    I'd guess they have around 12 songs each, on average (one only has 2, a number of them have 5 and a number of them have 18-20).

    Do the math. That's around 3600 songs.

    Okay, I don't know all of them *that* well, but there's probably only 10 of those albums that I couldn't name from playing a random song off of them and probably about 50 that I don't know all the songs. The rest of them I could probably name any song you played off the album (2880). Probably 1/2 of those I could sing/hum along with the song as well (1440). (Note: hum, since I own a number of instrumental or partially instrumental albums.)

    I'm not willing to guess as to the upper limit of typical memory on this one... since I would like to buy a lot more (when I can afford more), and I doubt I'll be forgetting too much of the past music.

  10. Re:And this guy is an editor? on PC Mag - Mac OS X Insecure · · Score: 1

    Apache is more common that IIS for webservers ... IIS must run on windows ... which is much more ubiquitous than *nix.

    I think you're mixing around the issues and comming out a little dizzy for it. The issue that you were asking about was the myth of "more popular == more exploits". Well, here's the situation: Apache is more popular than IIS; there are more (and more damaging) exploits for IIS than there are for Apache. Therefore, more popular does not equal more exploits. Really, the OS underlying the web server is somewhat irrelevant if you only look at exploits for web servers.

    Or, to put it another way, you said it yourself. There are many other factors involved (such as relative experience/knowledge required to run Apache vs. IIS). I agree completely. There is more at work than just the popularity of the product. Hence, using that metric is not acurate and the statement should be labled a myth.

    There are other vaiations as well. "People have more access to Windows (since its common) so its more likely to have exploits written." This one relies on what the "cracker" has at his/her desk rather than what is being used. Right, like Linux is really that hard to get ahold of compared to windows. Or, I suppose, they are claiming the "script kiddies" that are attacking in their spare time fall into this category (and they don't have the time or desire to find a linux distro to install). Okay, are you saying that it's *so* easy to get into Windows that a slightly bored kid can do it? ... and that it takes someone with determination to break into a Linux (or OS X) box. Oh, kind of telling, isn't it...

    Finally, you could have a discussion of "burden of proof" on the idea. Fact is, since Linux isn't more popular than windows, we can't test the theory... so its supposition, not fact. Sure it sounds reasonable, but it doesn't hold up to things like the Apache quote above. There are also a lot of papers that analyze the design principles that went into various windows products (like running code automatically, for example) to show why MS products are easier to break *by design*. (Note that the OS X exploit kind of falls into this "by design" category.)

    Hope that helps explain it a bit more... sorry if this seemed a bit long winded.

  11. Re:Is this book really neccessary?? on Software Exorcism · · Score: 2, Insightful

    So am I wearing rose-colored glasses and blinding myself to the cut-throat world of commercial software development, or is the author of this book simply over-reacting?

    Call it both, or a little of each. I've often felt that people will find conspiricies where they look for them. I've worked with people in the past that seemed to have issues with all sorts of co-workers - sometimes the same ones that I cam work just fine with. In a few of those cases, they were the ones making everyone else edgy, so it became a self-fullfilling prophecy.

    On the other hand, I'm not saying that a level of paranoia isn't apropriate. For myself, though, I agree with you, I see no reason to start keeping a paper trail of what I do at home in a vault. If I'm that insecure at my job, then I need to move to something else... for my own sanity, if nothing else. Fortunatly, I've never felt that way.

  12. Re:For those who've bought macs recently... on Mac OS X Panther 10.3 Reviewed · · Score: 1

    According to what was said on the annoucement day, all G5 owners qualify.

  13. Re:Surprised by single CPU keeping up with dual CP on PC World: Apple G5 Gets Trounced By Athlon 64 · · Score: 1

    Sure... Apple fans love the results from Apple's benchmarks and hate others. Apple detractors hate Apple's benchmarks and love ones that show slower scores. Neither one is a reflection of reality. Benchmarks all suck. Kind of like statistics, you need to know what the biases are of the person doing the reporting.

    That being said, I find that these benchmarks are lacking. The scores for Permier and Photoshop are close, the Word test is silly and I've always thought measuring FPS on a game is really silly. (Mainly because it measures the video card most of all, not the rest of the machine.)

  14. Re:What about widescreens...? on Multiple Monitors Increase Productivity · · Score: 1

    Right-click the taskbar and choose Tile Windows Horizontically or Vertically. Either way, no resizing windows.

    Surely, you're joking... right? I have 11 windows open right now (according to the task bar) and only 5 of them am I actually doing "work" in (some others are informational, one is a window with some shortcuts, one is a media player). If I do what you suggest (which I just did for fun), it completely screws up my workspace. Now, almost none of the windows is usable (horizontally or vertically).

    Like the grandparent post, I use the fact that I can maximize to one of my two screens a lot... its usefull for looking at firewall rules vs. logs, PHP code vs. web page, editing something vs. the e-mail with a request. There are a *lot* of tasks that I do on a daily basis that benefit from me being able to refer back and forth between two things, and the fact that maximize only takes up one of the two desktops is perfect. No window toggling and no resizing. When I'm done, I double-click the title bar again and the apps goes nicely back to where it was. Perfect.

  15. Re:HP 48GX on Recommendations for RPN Calculators? · · Score: 1

    I guess it comes down to personal experiance. When I was teaching, I had a classroom set of about 30 TI-83 calculators. I'm sure you can imagine the things that high school students put these calculators through (actually, they treated them fairly well - due in part to vigilance on my part - but there are accidents).

    The TIs held up pretty well, all things considered. I wouldn't have thought to warn people about them being fragile after seeing what they went through.

  16. Re:50 million numbers, not people on U.S. Court Blocks Anti-Telemarketing List · · Score: 1

    True... but it still demonstrates that its a lot more complicated than "phone==person" that some other posts have suggested.

    I was mainly arguing for accuacy of language, I probably shouldn't have wandered off with unfounded estimates (which all discussions of this type are going to be ripe with, since we can't really infer information about one data set from the other).

  17. 50 million numbers, not people on U.S. Court Blocks Anti-Telemarketing List · · Score: 3, Interesting

    Since I've seen this in numerous posts... please people, count right. The article said 50 million phone numbers are in the list, not people. I don't know about anybody else, but my household has 3 phone numbers associated with it, I have some friends that have 4 or 5 numbers that they have. Presumably, someone would list all the numbers associated with them, not just a single one.

    At a quick estimate, that puts the number close to 15 million people, not 50. (Okay, okay... still a big number, but a much smaller one when you consider that the US has about 275 million total. Around 5% instead of 18%)

  18. Re:The psychology of violence on Take-Two Interactive and Sony Sued Over GTA · · Score: 1

    Overall violence now is indeed pretty low. What we have here is an increase in violent crimes among young people. People are trying to find out why there were no columbines back in the 50's

    Well, actually, kids aren't that much more violent than they were in the past. The same statistics that show crime dropping overall in our society (for about the last decade) have showed almost no change at all for the younger age groups. Note, that means not much drop and not much rise in violence. (Actually, it looks like a slight decrese in the last few years, but it doesn't look particularly significant for the under 14 lot.)


    Take a look and see for yourself.

  19. Re:Nuclear Power is the future on World Nuclear University Launched · · Score: 1

    LOL... I've often thought about that as a "solution" - but could never think of a way to phrase it that most people would even begin to agree with. :)

  20. Re:Oh, Applescript... on Teach Yourself AppleScript in 24 Hours · · Score: 1

    Not sure if this answers your question or not, but by using the osascript command you can send a "one off" tell to an application without having to build an entire script. I've not used it much, but what I looked into once was using perl for the program logic, data analysis, etc. and then have perl call osascript to control something.

    Unfortunatly, you still need to know a little AppleScript to use that command, but you don't need to use it for all the program logic (I never really got a hand of AppleScript for anything other than just macros).

  21. Re:Ethics? Where was the human studies committee? on Smart Kindergarten · · Score: 1

    Precisely why is it more valuable scientifically to track kids' classroom interactions than it would be to track the interactions of, say, executives working in a corporation?

    Insightful? No. Try reading some of the research in the area. When a new teacher goes through an education program, they are given articles to read that span well over 30 years worth of research that has been done in classrooms. This is so teachers can see what best practices are and so they can get a better handle on how kids learn and how to deal with different situations.

    By the way, studies are also done in corporations as well... albeit not as often. Probably has a lot to do with the fact that quite a number of people are concerned about how their kids are getting educated. Nothing wrong with that. I'm comforted by the fact that my children will be taught by someone that has read research on teaching methods and student-teacher interaction instead of just guessing how things should go.

    This is uncomfortably reminiscent of the "Fernald Science Club" of the fifties in which MIT scientists fed mentally retarded kids radioactive tracers in nutritional experiments. It wasn't supposed to harm the kids,and it probably didn't, but it was highly unethical anyway--even by the standards of the time.

    You don't see these as just a little different? Giving children radioactive food (which seems to be the ethical concern here) vs. observing them? Where is the ethical harm in that?

    Before anyone says anything about consent or privacy, its worth noting that there are usually a lot of controls on these types of studies to make sure that the privacy of the children is maintained.

    There is some additional benefit in this study (as opposed to other classroom behavior studies that have been done) since it appears that there will be a less intrusive way to observe. To have a person sitting in the classroom or a video recorder running can be a little distracting to the kids. (They usually get over it quickly and forget about it, but I still wonder if that can skew the results.)

  22. Re:Who's being watched? on Smart Kindergarten · · Score: 1

    Won't happen for a long time (if ever) in most school districts I've worked with. There are typically strict rules as to when an official observation can happen and the teacher must know about it ahead of time. Although principals can come in an observe whenever they want, that observation can't go on the teacher's record.

    This may not be true in all school districts, but it was in the one I worked in and the ones I worked with.

  23. Re:Nickel Metal Hyride on Rechargeable Batteries - Yes or No? · · Score: 1

    Very interseting. I had heard it was a myth, but never seen an explaination as to why.

    BUT, I have one criticism of the article crying foul of there being no memory. The fact of the matter is (as even the author admits) that a Nicad battery will very likey come to a point in its life where it will seemingly discharge very quickly (I had a portable CD player that would only play for about 2-3 minutes before the batteries "died").

    Fine, this isn't memory.... so, what is it? The only reason I'm complaining is because until I have some other easily named effect to blame, I will probably go on calling it "memory" (knowing that it isn't).

  24. Re:repeat after me on Telemarketers Sue Over "Do Not Call" List · · Score: 1

    I'm not sure that there is any requirement that the phone be able to receive calls. I believe there is a requirement that there be a line that can be used to dial 911 (note, I didn't say a phone... just the line).

    I had a friend that worked for a 911 database company for awhile, a lot of it was verifing that locations had working numbers, but even if a number was disconnected (ie: resident stoped paying), they could still dial 911.

  25. Re:O'Reilly and their upgrade policy on The Web Programming CD Bookshelf · · Score: 1

    For $90, I could buy the collection brand new from Amazon without having ever spent a penny on O'Reilly's books.

    Sounds like you would be spending money on O'Reilly's books, then... just through a retail outlet, not direct.

    Don't get me wrong, I've always found this amusing, but it seems to frequently happen - that the "direct" approach is more expensive than other methods. I just don't get why you seem to be upset at O'Reilly, though. Don't like their price, find a price you do like, or don't buy the product. (And besides, as somone else pointed out, 30% is a pretty good deal - even if you found a better one elsewhere.)