Slashdot Mirror


User: jd

jd's activity in the archive.

Stories
0
Comments
13,841
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 13,841

  1. Re: How about basic security? on Why the Journey To IPv6 Is Still the Road Less Traveled · · Score: 5, Informative

    IPSec is perfectly usable.

    Telebit demonstrated transparent routing (ie: total invisibility of internal networks without loss of connectivity) in 1996.

    IPv6 has a vastly simpler header, which means a vastly simpler stack. This means fewer defects, greater robustness and easier testing. It also means a much smaller stack, lower latency and fewer corner cases.

    IPv6 is secure by design. IPv4 isn't secure and there is nothing you can design to make it so.

  2. Re: Waiting for the killer app ... on Why the Journey To IPv6 Is Still the Road Less Traveled · · Score: 3, Informative

    IPv6 would help both enormously. Lower latency on routing means faster responses.

    IP Mobility means users can move between ISPs without posts breaking, losing responses to queries, losing hangout or other chat service connections, or having to continually re-authenticate.

    Autoconfiguration means both can add servers just by switching the new machines on.

    Because IPv4 has no native security, it's vulnerable to a much wider range of attacks and there's nothing the vendors can do about them.

  3. Re: The answer has been clear on Why the Journey To IPv6 Is Still the Road Less Traveled · · Score: 1

    Each level is given the parent's prefix plus one or two bytes. Yes, you can announce that and it is easily summarized.

  4. Re: DNS without DHCP on Why the Journey To IPv6 Is Still the Road Less Traveled · · Score: 4, Informative

    Anycast tells you what services are on what IP. There are other service discovery protocols, but anycast was designed specifically for IPv6 bootstrapping. It's very simple. Multicast out a request for who runs a service, the machine with the service unicasts back that it does.

    Dynamic DNS lets you tell the DNS server who lives at what IP.

    IPv6 used to have other features - being able to move from one network to another without dropping a connection (and sometimes without dropping a packet), for example. Extended headers were actually used to add features to the protocol on-the-fly. Packet fragmentation was eliminated by having per-connection MTUs. All routing was hierarchical, requiring routers to examine at most three bytes. Encryption was mandated, ad-hoc unless otherwise specified. Between the ISPs, the NAT-is-all-you-need lobbyists and the NSA, most of the neat stuff got ripped out.

    IPv6 still does far, far more than just add addresses and simplify routing (reducing latency and reducing the memory requirements of routers), but it has been watered down repeatedly by people with an active interest in everyone else being able to do less than them.

    I say roll back the protocol definition to where the neat stuff existed and let the security agencies stew.

  5. What is wrong with SCTP and DCCP? on Google To Propose QUIC As IETF Standard · · Score: 4, Interesting

    These are well-established, well-tested, well-designed protocols with no suspect commercial interests involved. QUIC solves nothing that hasn't already been solved.

    If pseudo-open proprietary standards are de-rigour, then adopt the Scheduled Transfer Protocol and Delay Tolerant Protocol. Hell, bring back TUBA, SKIP and any other obscure protocol nobody is likely to use. It's not like anyone cares any more.

  6. Re: Must hackers be such dicks about this? on FBI Accuses Researcher of Hacking Plane, Seizes Equipment · · Score: 1

    He claimed he could hack the plane. This was bad and the FBI had every right to determine his motives, his actual capabilities and his actions.

    The FBI fraudulently claimed they had evidence a crime had already taken place. We know it's fraudulent because if they did have evidence, the guy would be being questioned whilst swinging upside down over a snake pit. Hey, the CIA and Chicago have Black Sites, the FBI is unlikely to want to miss out. Anyways, they took his laptop, not him, which means they lied and attempted to pervert the course of justice. That's bad, unprofessional and far, far more dangerous. The researcher could have killed himself and everyone else on his plane. The FBI, by using corrupt practices, endanger every aircraft.

  7. Re: Must hackers be such dicks about this? on FBI Accuses Researcher of Hacking Plane, Seizes Equipment · · Score: 1

    Did the FBI have the evidence that he had actually hacked a previous leg of the flight, or did they not?

    If they did not, if they knowingly programmed a suspect with false information, they are guilty of attempted witness tampering through false memory syndrome. Lots of work on this, you can program anyone to believe they've done anything even if the evidence is right in front of them that nothing was done at all. Strong minds make no difference, in fact they're apparently easier to break.

    Falsifying the record is self-evidently failure of restraint.

    I have little sympathy for the researcher, this kind of response has been commonplace since 2001, slow-learners have no business doing science or engineering. They weren't exactly infrequent before then.

    Nor have I any sympathy for the airlines. It isn't hard to build a secure network where the security augments function rather than simply taking up overhead. The same is true of insecure car networks. The manufacturers of computerized vehicles should be given a sensible deadline (say, next week Tuesday) to have fully tested and certified patches installed on all vulnerable vehicles.

    Failure should result in fines of ((10 x vehicle worth) + (average number of occupants x average fine for unlawful death)) x number of vehicles in service. At 15% annual rate of interest for every year the manufacturer delays.

  8. Re: In summary on GCC 5.0 To Support OpenMP 4.0, Intel Cilk Plus, C++14 · · Score: 1

    ADA updates would be good, bringing in the Spark 2014 and early 2015 extensions would have been nice. (Spark is a mathematically provable dialect of ADA. Well, mostly. Apparently, you can't prove floating point operations yet because nobody knows how. Personally, I think it's as easy as falling off a log table.)

    There are also provable dialects of C and it would be nice if GCC had a flag to constrain to that subset. Using multiple compilers is a good way of producing incompatible binaries and nasty interactions. GCC has no business having limitations. :)

    With work on KROC at a standstill, we have a reference compiler that talks Occam Pi. Occam is a very nice language to work with but working through archaic Inmos blobs is tiresome and limiting.

    Code quality in GCC and GlibC is still poor, the stability of internal interfaces is derisory (these should be generated from abstract descriptions, ensuring the flexibility GCC wants and the usability interface developers want) and the egos of the developers should be taken out and shot. However, it's still one of the best environments out there. Those that are better at specific things are usually carrying three to four digit price tags. I'd write in hand-turned assembly before paying for unquantifiable products that I won't even own.

  9. Re: In summary on GCC 5.0 To Support OpenMP 4.0, Intel Cilk Plus, C++14 · · Score: 1

    Different animal. Cilk has specific instructions for parallelising loops and similar. It looks like a similar concept to Fortran's capacity to turn anything that can be done as a vector rather than as a sequential operation into a vector instruction.

    OpenMP parallelizes at the block level rather than the instruction level. By all accounts (notably comments on the ATLAS mailing list), the performance is terrible.

  10. Re: stop the pseudo-scientific bullshit on Mysterious Siberian Crater Is Just One of Many · · Score: 1

    The Great Extinction, caused by Siberia becoming one gigantic lava bed (probably after an asteroid strike), was a bit further back in time. Geologically, Siberia is old. You might be confusing the vestiges of Ice Age dessication (which was 10,000 years ago) but which involves the organics on the surface with the geology (aka rocks).

    Regardless, though, of how the craters are forming, the fact remains that an awful lot of greenhouse gas is being pumped into the air, an awful lot of information on early civilization is being blasted out of existence, and a lot of locals are finding that the land has suddenly become deadly.

  11. Re: Authority on As Big As Net Neutrality? FCC Kills State-Imposed Internet Monopolies · · Score: 2, Interesting

    That is a good question. The last time the courts ruled on this, the ruling was that the FCC had ceded power and couldn't claim it back without the will of god. Or Congress, or something.

    Personally, I'm all in favour of Thor turning up to the Supreme Court, but he probably wouldn't be allowed in on account of not having a visa.

  12. Re: 0pointer's 30 myths about systemd on As Big As Net Neutrality? FCC Kills State-Imposed Internet Monopolies · · Score: 4, Insightful

    Myth: Anyone gives a damn about factually dubious rants.

  13. Re: Systemd, for or against? on As Big As Net Neutrality? FCC Kills State-Imposed Internet Monopolies · · Score: 4, Funny

    As far as I know, Systemd has no capacity to think and therefore has no opinion on net neutrality.

  14. Yes and no on Moxie Marlinspike: GPG Has Run Its Course · · Score: 1

    First, the complexity of the engine shouldn't matter. You will never get the bulk of users out there to use, or care about, the real power of the engine. They don't want to mess with the engine. The engine should be under the hood, in a black box, whatever engineering metaphor you want. Users just want things that work.

    I remember way back when I was at university. There were various absolute rules for good software engineering. The first was that the user should be presented with a must-read manual no longer than one paragraph. Tips and tricks could be more extensive, but that one paragraph was all you needed.

    The second was that the user absolutely must not care about how something was implemented. In the case of encryption, I take that to mean, in the case of e-mail, that the engine should not be visible outside of configuration. A supplied key should trigger any behind-the-scenes compatibility mode or necessary configuration to talk to that user. If the keys the user has aren't suitable to correspond with that person, the system should ask if one is needed and tie it to that protocol.

    There should be no extra controls in e-mail, except at an advanced user level. If a key exists to correspond with a user, it should be used. If a key exists for inbound e-mail, the key should be applied. The process should be transparent, beyond getting passwords.

    Any indexes (particularly if full indexes) should be as secure as the message, good security practices on both will take care of any issues.

    Ideally, you want to have the same grades of authentication as for the early certification system, adapted to embed the idea that different people in the web of trust will have done different levels of validation and will be trusted to different degrees. The user should see, but not have to deal with, the level of trust.

    Last, GnuPG is probably not the system I'd use. Compatibility cruft needs to be as an optional layer and I'm not confident in implementation.

    There should be eight main libraries - public key methods, secret key methods, encryption modes, hashes (which encryption modes will obviously pull from), high level protocols, key store, index store and lacing store. (Lacing is how these are threaded together.) The APIs and ABIs to those libraries should be standardized, so that patching is minimally intrusive and you can exploit the Bazaar approach to get the best mix-n-match.

    There should also be a trusted source in the community who can evaluate the code against the various secure and robust programming standards, any utilized theorum provers and the accepted best practices in cryptography. Essentially replicate the sort of work NIST does, but keeping it open and keeping it free of conflict of NSA interest.

  15. Translation on Credit Card Fraud Could Peak In 2015 As the US Moves To EMV · · Score: 2

    US businesses are as incompetent and insecure as Sony, but can be provoked into taking absolutely minimal action when their profits are under direct threat by sufficiently powerful financial organizations. You mean nothing, you never have, you never will. You have no say, you have no power, you have no rights, you cannot walk away. You aren't the customer, merely the product. Easily replaced if damaged.

    You aren't getting security because security matters. You aren't getting security because you matter. You're getting it because two vendors and a trading bloc said so.

  16. Re: Scaled Composites renamed on Virgin Galactic Dumps Scaled Composites For Spaceship Two · · Score: 1

    Solar sail can achieve 25% light speed, according to NASA, and Alpha Centauri is 4 light years away.

    You want a manned mission (with robots doing all the actual work) to determine if the conventional wisdom that a manned mission to the outer planets is physically impossible is correct. Even if the pilot dies, you learn the furthest a manned mission can reach. There's seven billion people, you can afford to expend one or two. Ideally, they'd be volunteers and there'll be no shortage of them, but if you're concerned about valuable life, send members of the Tea Party.

  17. Re: Scaled Composites renamed on Virgin Galactic Dumps Scaled Composites For Spaceship Two · · Score: 1

    No big surprise. The military are willing to invest what it takes for what they need. Military entities are, by necessity, pitifully naive when it comes to anything useful, but once they specify what they think they want, they don't shirk at the cost, they get the job done. A pointless job, perhaps, but nonetheless a completed job.

    The corporate sector wants money. Things don't ever have to get done, the interest on monies paid is good enough and there hasn't been meaningful competition in living memory. Because one size never fits all, it's not clear competition is even what you want. Economic theory says it isn't.

    The only other sector, as I have said many times before, that is remotely in the space race is the hobbyist/open source community. In other words, the background behind virtually all the X-Prize contestants, the background behind the modern waverider era, the background that the next generation of space enthusiasts will come from (Kerbel Space Program and Elite: Dangerous will have a similar effect on the next generation of scientists and engineers as Star Trek the old series and Doctor Who did in the 1960s, except this time it's hands-on).

    I never thought the private sector would do bugger all, it's not in their blood. They're incapable of innovation on this kind of scale. It's not clear they're capable of innovation at all, all the major progress is bought or stolen from researchers and inventors.

    No, with civilian government essentially walking away, there's only two players in the field and whilst the hobbyists might be able to crowdsource a launch technology, it'll be a long time before they get to space themselves. The military won't get there at all, nobody to fight, so the hobbyists will still be first with manned space missions, but it's going to take 40-50 years at best.

    We have the technology today to get a manned mission to Alpha Centauri and back. It would take 15-20 years for the journey and the probability of survival is poor, but we could do it. By my calculations, it would take 12 years to build the components and assemble them in space. Only a little longer than it took for America to get the means to go to the moon and back. We could actually have hand-held camera photos taken in another solar system and chunks of rocky debris from the asteroid belt there back on Earth before Mars One launches its first rocket AND before crowdfunded space missions break the atmosphere.

    All it takes is putting personal egos and right wing politics on the shelf, locking the cupboard and then lowering it into an abandoned mineshaft, which should then be sealed with concrete.

  18. Just run the cable through a guitar amp. I mean, what can possibly go wrong?

  19. Yet Another X-Bone on 'Silk Road Reloaded' Launches On a Network More Secret Than Tor · · Score: 4, Informative

    People have been designing virtual networks for decades. I2P is well advertised on Freenet, itself a well-known secure network.

    Nothing new here. The security and reliability of none of this software is proven, it may not even be provable due to the distributed nature. That reduces the problem to one of how many people you're ok with knowing what you're doing.

  20. Re: any repercussions? on Porn Companies Are Going After GitHub · · Score: 1

    I honestly doubt any severe repercussions will occur, the DMCA is too weasel worded. Defamation is another matter. Accusing a company like Atlassian of hosting pirated porn is a serious commercial matter. (Slandering open source developers is another matter, freedom of speech and all that, America hasn't really grasped the concept of reasonableness and balance.)

    Accusations that are clearly defamatory against a commercial entity can harm political donations, jobs in battleground states, and inflict restraint of trade, on the long run-up to a major and likely to be bitter election... That is clearly not going to fly with elected judges and elected political representatives.

    The question is whether legitimate businesses involved in legitimate trade will simply ignore the action or file for defamation. Winning or losing doesn't matter, most of the porn companies are probably small enough that bad publicity and legal fees will cripple them. Obviously winning (even if by default) would be better, it would create case law on the issue.

    The problem with DMCA is that we've been here before many times. And there have been DMCA cases the industry has lost. Yet nothing has changed, no precedents have been set, no behaviour on the part of industry or takedown farms has been modified. You'll have to do something new.

  21. Bah, humbug! on How Amazon's Ebook Subscriptions Are Changing the Writing Industry · · Score: 0

    The Kindle does not support LaTeX3+Lua. I refuse to accept that books, real books, can be circulated as a cut-down HTML5 file. Doubly so after reading a large number. Formatting errors, image errors, broken linkage, broken tables, random start page, broken tables of contents, screwball fontage - these convince me that HTML-only writers should not be allowed near a computer until launched by canon from the top of the Matahorn.

  22. If... on Neglecting the Lessons of Cypherpunk History · · Score: 1

    You are vulnerable to Social Engineering (and almost everyone is), no security of any kind will ever work. Become a Scottish crofter, it's your only hope of a life.

    You are a private individual, see all XKCD coverage. Same remedy.

    You are Sony, abandon hope now. You wouldn't even make it as a crofter.

    You are anyone else, encryption is not enough. You want segmentation, active NIDS, proxies and firewalls at the gateways, HIDS on the machines, role-based access controls, host-to-host IPSec, security labels on packets, total removal of all vulnerable protocols, disk encryption, strong authentication and Neuromancer's Black Ice. A platoon of extreme freediving Ninja with enhanced magnetic sensors in their eyeballs would help, too.

  23. Re: Diversity is good, especially in SciFi on Overly Familiar Sci-Fi · · Score: 1

    Science fiction isn't fiction that has elements that aren't science but might appeal to geeks who like science.

    Science fiction isn't science fantasy.

    Science fiction isn't pure fantasy with stuff science geeks like.

    Science fiction isn't biologically improbable females fulfilling spotty teen fantasies.

    Science fiction is science that is fictional. Very different animal and naturally restrictive.

    That's life. Or will be.

  24. Re: you're doing it wrong on Overly Familiar Sci-Fi · · Score: 0

    Absolutely wrong on all accounts.

    People are the least important part of a story, they exist solely to represent something. What they represent is almost never another person. In fact, it is never another person.

    Science fiction is about the universe, about meaning, about the nature of reality. There are perfectly good science fiction stories that don't include people, or indeed any living thing. And that is fine.

    Stories that are people-centric are no more science fiction than vampire stories are history, or Microsoft manuals are about learning.

    This isn't up for discussion, it is the way the ontology is. Don't like it? Fine, don't call your crap science fiction. It's very simple.

  25. If... on Overly Familiar Sci-Fi · · Score: 1

    ...It's Cheers in Space, or Eastenders on Mars, then no it is not science fiction. It is Cheers in Space or Eastenders on Mars. There is no science and there is precious little fiction.