Slashdot Mirror


User: karlm

karlm's activity in the archive.

Stories
0
Comments
542
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 542

  1. Re:When this happens... on Hotmail No Longer Accepts Long Passwords, Shortens Them For You · · Score: 1

    Same thing with GMail, alphabetics and numbers only.

    Your post is ambiguous, but it seems you're asserting that GMail does also not allow symbols in passwords. I'll bite. My GMail password contains one or more symbols. Have fun with your 1-bit head start on cracking my 80+ bit GMail login.

  2. Saudi Arabia's terrorist rehabilitation plan on Modest Proposal For Stopping Hackers: Get Them Girlfriends · · Score: 1

    Saudi Arabia has a program for paroling convicted terrorists. Young single men convicted of certain terrorism-related offenses who meet certain good behavior criteria in prison are given dowry money and assistance in finding brides. It turns out that the re-arrest rate for the guys who get married is significantly lower.

  3. Re:It's always been obvious on The PHP Singularity · · Score: 1

    You misunderstand the saying. It's a poor mechanic who blames his tools for his mistakes because (1) he screwed up and (2) he perhaps knew his tools were bad but didn't even have the good judgement to get better tools (3) by his blaming demonstrates a lack of his ability to see (2) as an error and thus move on and grow.

  4. Re:Huh. on How Many Seconds Would It Take To Crack Your Password? · · Score: 1

    there aren't many botnets out there with half a million machines busy trying to crack my Starcraft password.

    Correction: yesterday there weren't many botnets with half a million machines trying to crack Guspaz's Starcraft password.

  5. Re:What about Chernobyl plant? on 'Legitimized' Cyberwar Opens Pandora's Box of Dirty Tricks · · Score: 1

    Even for a paranoid conspiracy theory, that's a terrible theory. You forgot to use the words "laser", "fluoride", "chemtrail", "thermite", and "Gay Mayan Leprechaun Ninjas from the year 2012." Also, of course, the Chernobyl explosion was caused by the CIA in order to cover up the fact that Obama was born in a Nicaraguan Satanic temple earlier that day... making him too young to be president.

    Either the Soviets didn't realize that they had been the victims of a cyber attack because the Americans waited until the very moment that a Soviet reactor operator decided to wing it in an attempt to salvage an already highly dangerous nuclear experiment (interrupted by an unexpected request for more power output to the grid) with a reactor with a positive void coefficient... or the Soviets decided to make up such a story after the fact in order to make themselves look bad rather than take the opportunity to blame the Americans for the disaster... and that's even assuming that the RBMK reactors were controlled by programmable digital computers connected to satellite downlinks.

    Satellites, nuclear reactions, computer viruses, and secretive government agencies... what a good mix for a conspiracy theory. Everyone wants to feel like they're in the top decile of intelligence. A good conspiracy theory gives people with a slight paranoid streak an opportunity to believe they're smarter than most people because they "get it". A good conspiracy theory also plays to the American folk hero of the misunderstood genius that's too smart for book learn'n and despite a complete lack of discipline out-smarts a legion of PhDs and comes up with an idea that revolutionizes modern science. It's the nerd version of the scrappy sports team that pulls it together to win it all against the bigger spoiled rich kids in the final game.

    News flash: when most of the world's experts in the field "just don't get" a theory posed by a novice, chances are it really is gibberish proposed by someone without enough knowledge to comprehend the experts' rebuttals and too much pride to admit their own shortcomings.

  6. Re:doesn't work like that on Senators To Unveil the 'Ex-Patriot Act' To Respond To Facebook's Saverin · · Score: 1

    I'll grant you that here's probably a lot more necessary complexity in the tax code than most of us realize. However, there's also a lot of unnecessary complexity in the tax code. Some of the additional complexity comes from political favors for large donors or important political constituencies. Some of the complexity comes from attempts to use a power granted by the Constitution (taxation) as a way to exercise powers that are not allowed the federal government by the Constitution.

    A complex tax code is sand in the gears of the system, and a handout to law firms. I'm not familiar with non-US tax systems (apart from the country where I currently live), but conventional wisdom is that many countries are existence proofs that the U.S. tax code is overly complex.

  7. Re:Sour Grapes on Senators To Unveil the 'Ex-Patriot Act' To Respond To Facebook's Saverin · · Score: 2

    I couldn't agree more. (1) He paid capital gains when he renounced his citizenship. (2) He paid what was deemed "his fair share" in taxes while living in the U.S.(3) He took startup risks, created tons of jobs (both at Facebook and the ecosystem that rose up around it) and paid a good chunk of taxes while he was here.

    There are already several places around the world with both regulatory and tax systems more favorable to entrepreneurs. Let's not create laws that send the message that it's a better idea to create the startups elsewhere, and let's not encourage a culture that exposes entrepreneurs to significant risk of retroactive taxation.

    We already spend untold billions attempting to enforce our unenforceable tax code, created a huge industry dedicated to finding loopholes in our complicated tax code, and lose untold bilions to fraud that's enabled by our complicated tax code. Let's not try and make the tax code more complicated because we feel he had some capital gains that couldn't be accounted for at the time capital gains were assessed.

  8. Re:The nerve on Senators To Unveil the 'Ex-Patriot Act' To Respond To Facebook's Saverin · · Score: 2

    And somehow the money he paid in taxes while residing here was deemed his fair share at the time, and he should be retroactively taxed more for those service if he later derives some huge benefit from those services? Should every person who gets an education in the U.S. have to pay some tax to the U.S. for the rest of their lives, no mater their citizenship and place of residence?

    I'm not comfortable with the idea that he was somehow building up some secret debt while living here and working here, and "paying his fare share" in taxes and creating tons of jobs. If after he leaves and changes his citizenship, he later derives some benefit from what he did in the U.S., more power to him.

    We already have a tax system that's so complicated as to be unenforceable. It costs us billions of dollars a year to try and audit the tax system, and further billions are lost to tax fraud. Let's not make these leaks in the system greater (and drive away entrepreneurs) by devising further complications in the tax code to try and account for these "almost realized, 99% certain" gains before people move change citizenship and move overseas.

  9. Re:So like the Soviet Union? on Senators To Unveil the 'Ex-Patriot Act' To Respond To Facebook's Saverin · · Score: 3, Insightful

    As long as welfare is a handout and not a loan, I think welfare recipients should be under no obligation to "pay back" what they "took", even if they later make a lot of money in some way that you seem to find unjust yet legal. Their benefits aren't tied to some formula of taxes paid before going on welfare, and their taxes afterward shouldn't be tied to some formula dependent on how much they were paid by welfare.

    "Passive-agressive tax system" isn't really the phrase I'm looking for, but there seems to me something morally wrong about holding someone in debt to society for a handout (not a government loan).

    Perhaps there should be, in addition to welfare, a system of zero-interest government loans for people in need. However, I think it's a step backwards to turn welfare into a loan system.

  10. Re:No password? on Here's What Facebook Sends the Cops In Response To a Subpoena · · Score: 1

    Following the large number of very public password disclosures in the past couple of years, failure to hash passwords (salted by username, user ID and/or random nonce) should be considered gross negligence.

    Are there any proposals to standardize a password column type for SQL databases? If the column is write-only but comparable for equality against a varchar/string then the implementation details of hash algo and salting are hidden. The sad thing is that proper password storage could be made a lot more intuitive, even for the "just learned XYZ in 24 days/hourse" crowd.

  11. Re:Darn that dirty hydrogen on Self-Sustaining Solar Reactor Creates Clean Hydrogen · · Score: 1

    Methanol is used as a racing fuel. Its energy density, anti-knock, and storage characteristics are worse than ethanol, though. My understanding that the main reason that methanol is used as a racing fuel is that it's very easy to test for performance-enhancing illegal additives. If I had to take a guess, the low molar mass of methanol means that it's tough to find a compound that both enhances its performance as a fuel and won't be readily detected via centrifuge or perhaps a mass spectrometer.

  12. Re:We've tried several times... on Google Pumps $6 Million Into Summer of Code 2011 · · Score: 1

    That's an existence proof, not proof by contradiction.

  13. Re:Uh, correct me if I understood the story wrong on AT&T Breach May Be Worse Than Initially Thought · · Score: 1

    At some point, I wrote a small tool that used Ron Rivest's "Time Lock Puzzles" to provide lagged full disclosure... publish full disclosure that will take several months to decrypt, and privately give the vendor the decryption key to give them a head start. Getting a gag order from the courts won't help the vendor at that point, since you've already published the encrypted information and the puzzle, it's just a matter of grinding through the time lock puzzle. The time ticking on the time lock puzzle should hopefully light a fire under their rears to get a fix out. IMHO, time locked full disclosure gives you the best of both worlds... vendors have some reasonable time to implement a fix, but no amount of legal action can prevent the details from getting out several months later. The risk of "responsible disclosure" is that you can get slapped with a gag order, or at least legal threats, to prevent you from later putting pressure on the vendor for a faster fix.

  14. Re:Uh, correct me if I understood the story wrong on AT&T Breach May Be Worse Than Initially Thought · · Score: 1

    They didn't enter into AT&T's network uninvited, they used a public facing and unprotected URL to retrieve information that URL was intended to retrieve. This is no more intrusion than if AT&T had put that data in a public facing flat file on a server somewhere and hoped nobody discovered the URL.

  15. Re:Good for them! on Microsoft Launches Comical Effort to Fight Piracy · · Score: 1
    Pirates were a real threat back in the 1600s. They were the terrorists of the day.


    "Book terrorists! Book terrorists! A vote against this bill is a vote for the terrorists!"


    Maybe we should start calling price fixing "price terrorism" or installing rootkits "system terrorism".

  16. Re:Yes it is an encryption algorithm on Chinese Prof Cracks SHA-1 Data Encryption Scheme · · Score: 1
    Kindly note that SHACAL leaves out the variable chaining that is used to make a SHA-1 more difficult to invert.


    Also kindly note that Davies-Meyer constructions (and similar secure constructions) use a state-chaining step to make it more difficult to invert a block.


    You can turn a block cipher into a hash algorithm as well, by using the data to be encrypted as the key.
    I assume by "data to be encrypted", you mean "block of data to be hashed". If you naively string together block cipher encryptions without taking care to make it non-invertible, you break its second-preimage-resistance. In Rivest's 6.857 class, we were asked to find a second preimage from a hash function that naively chaned together RC5 encryptions. (The assignment used 32-bit block size RC5 so that students that didn't figure out the trick could still get partial credit by bruit force.)


    Search for Davies-Meyer construction for more information on constructing ideal iterated hash algorithms from ideal block ciphers.

  17. Re:What is he smoking? on Google's Sinister(?) Plans · · Score: 1
    Oh, come on. Do you really think that copying diffs of the entire visible World Wide Web to hundreds or thousands of locations really takes that much bandwidth? I'm pretty sure only the Slashdot main page, the Google news main page, and about 1 or 2 other web pages change on the average day, worldwide.


    Google must be conspiring with aliens, gays, and the Chinese government to need that much bandwidth.

    Now please excuse me while I stock up on AA call options. I feel an aluminium foil shortage coming on.

  18. Re:Now even higher in ranking on Online Store to Sue Blogger Over Google Ranking? · · Score: 1

    I think I spoke too soon. It looks like Slashdot inserts the rel="nofollow" attribute instead of merely preserving it.

  19. Re:Now even higher in ranking on Online Store to Sue Blogger Over Google Ranking? · · Score: 1

    It looks like slashdot inserts the rel="nofollow" attribute on anchor tags, so the rankings in Google, Yahoo, MSN, and other search engines won't be affected.

  20. Re:Now even higher in ranking on Online Store to Sue Blogger Over Google Ranking? · · Score: 1
    I'd give you the link, but ironically that would boost his pagerank, so instead

    Let's see if Slashdot preserves the rel="nofollow" attribute on anchor tags.

    Slashdot seems to preserve the rel attribute in the preview, so I'm guessing Slashdot will preserve the attribute after I post, as well.

  21. Re:Okay... on Judge Says RIAA Can't Have Hard Drive · · Score: 1
    2. All the cases I have seen are Kazaa, Limewire, Gnutella, or iMesh.... i.e. FastTrack clients.

    Gnutella is a protocol. (The original Gnutella client, caled simply Gnutella, died out long ago and the protocol has evolved enough that Gnutella couldn't connect to the modern Gnutella network). Maybe you're thinking of Gtk Gnutella, which is a modern OSS Gnutella client. LimeWire supports the Gnutella and BitTorrent protocols, but not FastTrack. I'm not sure about which protocols are supported by iMesh.

  22. Re:been around forever on Joanna Rutkowska Discusses VM Rootkits · · Score: 1
    If you think you can always recover (or even decect) a compromise once the kernel has been commpromised, you're fooling yourself. All of this complaining is just knee-jerk reactions to suddenly discovering that the emperor has never been wearing any clothes.


    The correct way to fight blue-pill would be to create a minimal hypervisor that always runs under windows, and only prevents new code from joining it in hypervisor mode.

    Adding an instruction to check if you're inside a VM, without having that instruction trapped by the hypervisor, would violate the Popek-Goldberg virtualization requirements.

    The whole point is that code can't tell if it's running on top of a hypervisor. It would be really stupid for Windows to be able to freak out and quit running if it noticed that it was sharing a machine with OS X and Linux and OpenBSD and BeOS. You want hardware that conforms to the Popek-Goldberg virtualization requirements. IBM has had such mainframe hardware since 1970. It's a Good Thing (tm).

    Once the kernel has been compromised, it's game over, period. There are currently open-source pieces of software able to virtualize the x86 (Qemu running on x86, using the Qemu kernel module, for instance). Slight modifications to this software would allow the guest kernel direct access to the real hardware. Steps could be taken to supervise access to DMA and other routes that a kernel could tell that it's running in a virtualized environment. A rootkit could page out enough memory to make room for a Linux kernel and some virtualization software, then map all the rest of the memory into into the virtualization software's address space, and tell the virtualization software to start running the host kernel where it left off. The hosted kernel wouldn't be able to tell that it had suddenly been moved out of ring 0.

    These new features that allow x86 hardware to conform to the Popek-Goldberg virtualization requirements simply make virtualization more efficient and less bug-prone. It would be very difficult to use efficiency to detect a rootkit, as the rootkit could modify the code that checks timings. The emperor has never been wearing clothes. Sorry to freak you out.

  23. Re:Jon Lech Johansen has it wrong... on DVD Jon's DoubleTwist Unlocks the iPod · · Score: 1
    Since when can you overwrite a used sector on a CD-RW?

    The most obvious difference between CD-Rs and CD-RWs is that CD-Rs are write-once read-many media while CD-RWs are re-writeable. That's why people are willing to pay more for CD-RWs.

    I'm a bit curious. What did you think was the main advantage of CD-RWs over CD-Rs?

  24. Re:Encrypting Swap Space or Not on Why Not Use Full Disk Encryption on Laptops? · · Score: 1
    If you're worried about smarter thieves who will opportunistically use the information on the system if they can access it, then file system encryption is critical but swap space encryption probably isn't.

    I once grepped my OS X Panther swap file for my password, and found 7-10 occurances. I was surprised (but obviously not too surprised, as I was looking for it). I'm glad that Tiger has an encrypted swap option. Under most schemes, once an attacker has your login password, they can decrypt your home directory.

    In addition, once you start swapping, you're taking a huge performance hit. You may not notice the increased overhead of encrypted swap on your laptop.

  25. Re:two dual-cores? on AMD 4x4 Quad Father, Quad Core CPU Details Emerge · · Score: 1
    I thought AMD was bragging about how their qaud-core CPUs were going to be "native," unlike Intel's which were going to just be two dual-core CPUs on one die? Or is this 4x4 platform not meant to be their real quad-core solutions, just an interim "hack" until the quad-cores come out in 2007?

    Intel's current quad-core solution is 2 dual-core dies in a single package, not "two dual-core CPUs on one die".

    In this context, my definition of "a hack" is engineering short-term solutions that don't have much benefit for long-term solutions. Note that source-code tricks and protocol tricks that later get in the way of maintainability and extensibility are hacks by this definition. Some hacks may be elegant by this definition.

    High-speed links between different packages was part of the HyperTransport design from the beginning. Any improvements AMD makes to the HyperTransport bus in order to increase the performance of its 4x4 products will still pay performance dividends after the 4x4 marketing campaign is over. It's a marketing ploy to hold market share until the quad-core 65 nm chips come out, but hardly a hack.

    Intel hid two dual-core dies in a single package and called it a quad-core without any of the power consumption or inter-processor latency benefits of a single-die solution. Once Intel moves to a single-die solution, the advances they made in duct tape technology will stop paying dividends. That's a hack, similar to the MHz-boosting techniques that were developed for the P4 and later abandoned when the Pentium-M was derrived from the PIII and the Core serries were derrived from the Pentium-M.

    Note that from a business perspective, if Intel's research teams are large enough that adding more people to long-term projects would be counter-productive, it does make sense to make teams for engineering hacks in order to keep market share and thereby reduce the research budget of AMD. On the other hand, it seems that AMD needs to make as efficient use of every engineering hour as possible, and it therefore wouldn't make sense for AMD to go through all of the engineering effort to put two dies in a single package as a stop-gap.