Slashdot Mirror


User: micromuncher

micromuncher's activity in the archive.

Stories
0
Comments
566
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 566

  1. Many Sides to Security on Recommendations for Third Party Security Audits? · · Score: 1

    It might be cheaper to hire a contractor/employee that specifically audits security over 3 months. Security is such a broad field that I would not trust any one or two day "audit". The contractor should start to produce a check list of "things to check" and follow recent cert advisories. Then you'd need to start enumerating your technologies and look for holes. Here are some examples from experience:
    1) user accounts and domain security
    2) database security (Yes son, how many SYSTEM MANAGER Oracle databases are exposed through the net)
    3) router security (is a hacker living in your router? many smart devices have telnet interfaces for configuration)
    4) application server security (did you know I can dump the JNDI tree from many a Java application server and people tend to bind in account names and passwords?)
    5) service security (from FTP to NFS - guest accounds are bad, is rwhod or fingerd running?)
    6) firewall security (what is filtered, what is logged, which ports are open, is WINS open?)
    7) LDAP security (a topic unto itself)
    8) physical security (what, you mean I can hit reset on this solaris sun box and reboot with kdb?)
    ...and the list goes on.

  2. Re:Attention California on California + Oracle = $95 Million Fiasco · · Score: 1

    Ah yes, anonymous Nazi, you are right I am not entitled to voice an opinion.

  3. Re:Attention California on California + Oracle = $95 Million Fiasco · · Score: 1

    Yes, because government forces are keeping out UN mission (a CNN headline), and other foreign assistence.

    Some alternative media persists:
    http://jerusalem.indymedia.org/news/200 2/04/13987. php

    Don't worry, it is always easier to discount than to disprove something, the intent of your comment.

  4. Great Idea! Extrapolate! on Taxing Sci-Fi Products to Fund NASA? · · Score: 1


    I think this is a great idea because when you extrapolate this meme just think of the SAVINGS you'd get with directed taxes...

    - military funding by people who support war books and toys
    - arts funding by people who support whatever art
    - education funding by people with children (buying educational books)
    - sports funding through people who buy sports illustrated
    - health care funding by sick people
    - foreign aid by the creed (WOOT! no more 13 billion including my tax dollar to buy tanks and guns for Israel to kill Palestinians armed with sticks and stones)

  5. there will come soft rains on How to Build a Computerized Android Robot Head · · Score: 1

    This wins my cool hack of short attention span award.

    WTG!

    I wonder if it dreams of electric sheep.

    Mm

  6. Re:Attention California on California + Oracle = $95 Million Fiasco · · Score: 1

    Who rates this crap? ./ ratings are almost as useful as CNN headlines.

    "Ariel Sharon gets hang nail banging fist on table," as opposed to 300 to 500 Palestinian refugees executed in Jenin.

    Benny Bin Ben-Eliezer

  7. Re:I think, he believes that if he says... on Trouble Ahead for Java · · Score: 1

    I still write C/C++ applications under the credo right tool for the right job. And for it is not business sense, I am LAZY (some people call it efficient.) I hate spending time coding solutions that already exist because smarter people have already come up with good solutions.

    As for studying C [C++] properly... my nickname was Bjarnie. You don't get a nickname like that unless you are a purist. I can almost cite ARM with the best of them ;-)

    Java is pervasive in enterprise exactly because those bad ideas are 80% of the shit work. So I can spend my day getting at business logic, or solving architectural issues! Its not religious at all - its purely pragmatic.

  8. Re:kyoto? on Goodbye Global Warming!...Hello Terraforming? · · Score: 1

    Not killed; they just made it someone else's problem. It is the EU, not Americans, that are pushing Kyoto into every new economic discussion. Take the recent Environmental preamble to the G8 conference. Number one issue again and again was Kyoto; and Canada got slammed for its Hypocritical stance on it. AND the province in which the G8 is being held, the Provincial leader has REFUSED to support G8, even if the country supports it, because Alberta's primary industry is energy, and any environmental reform eats a little into Oil and Gas PROFITS. That's right - PROFIT. And not BIG bites. Little bites. [We will not support changes for tomorrow because we want to know exactly how much profit will be lost today.] Screw it if we are all dead tomorrow. Make that buck today.

    Michael Moore, Stupid White Men is a great book.

    B.

  9. amusing on Goodbye Global Warming!...Hello Terraforming? · · Score: 1

    Very interesting article, but I am left with the following musings...
    1) Science will solve a problem that science got us into; that means another link in the chain of problems. (Lets put more CO2 into the air so we can harvest it and continue carbon based combustion.)
    2) The US is staunchly against Kyoto, and now Canada is double tracking on Kyoto, because of "unknown financial impact on the economy" that really means "it will cost too much" where it is "the economy" that has caused the problem.

  10. ./ misrepresents the article on Trouble Ahead for Java · · Score: 2, Interesting
    Once again the intent of the article is to KNOW YOUR ENEMY. Williamson tries to quash some arrogance on the part of the Java community and reiterates the M$ media machine can win the mindshare of decision makers.

    Riding home on the train last week, I was listening to two "software guys" talk about the issue. The summary, "Wow! Microsoft! .NET! Java is dead." "Do you know any Java?" "Yeah I took a course."

    The guy took one course as a "programmer" and is an instant expert. Microsoft LOVES the instant expert, and books devoted to the programming shaman are dedicated to stroke their egos before the technologies are publically released.

    My point is that its not just the high end decision makers that M$ buys, but also the low end technoweenie.

    (The conversation proceeded to Oracle is dead 'cause its over priced, SQLServer rules the world - at which point I wanted to YELL M$ IS PAGE RECORD LOCKING F**KHEAD - then I realized that saying that I'd likely get the same blank stare as my mother gives me when I talk computer talk.)

  11. Re:I think, he believes that if he says... on Trouble Ahead for Java · · Score: 1
    I personally believe that Java and C# both suck by themselves, both are "poisoned technologies" (ones that carry arbitrary idiosyncrasies built into them just to advance the agenda of their creators -- the only positive example of "poisoned technology" that I have seen is fictional -- it's Asimov's robots, and even they aren't completely positive), that they pretend to solve existing problems while actually solving the problems that people have yet to invent.

    Hmmm... have you ever tried to write a real multi-threaded app. in C/C++? What about a cross platform (I don't mean BI platform) networked application in C/C++? Hello, have you written a caching immutable string factory? Sorry dude, picking proprietary libraries or rolling your own is just bad business sense, and saying that languages perks are pushing agendas or solutions looking for problems only shows ignorance [by definition] on your part.

  12. This will NOT be Eq as we know it. on Everquest Coming To the PS2 · · Score: 1

    This will be an "Everquest-lite", called Everquest Online Adventures, so there will be no interaction with the usual EQ world.

    In the last Everconn QA, the question to developers was asked "Will there be a MacOS version of EQ?" The answer was "Everquest is totally dependant on DirectX, and will always be a DirectX game. There will be no Mac version."

    PS2 doesn't support DirectX, does it? With DirectX portability/emulation APIs recently released on top of OpenGL, I wonder if EQs development staff has anything to do with this. The release states this is a "ground up" development.

    I guess Sony is wielding a double edged sword.

  13. Testament to the game on Blizzard/Vivendi Files Suit Against Bnetd Project · · Score: 1

    I Loved Devil 2.

    But the lag got so bad, and so many disconnects, I quit playing. I even bought the extension pack, but couldn't play it... [However the lag was bad and disconnects because of people trying to cheat supposedly... though many people blamed Koreans for some odd reason.]

    What do you expect? BAFFLE.NUT is not pay per use. Why should Buzzard support it?

    BNUTD was a testament to the games quality (high) and the multiplayer capability (poor). If you don't like the quality of something you buy, take it back. Send mail to Buzzard asking for a refund.

    Mm

  14. Why not Update the GPL... on Microsoft Tech Specs Prohibit GPL Implementations · · Score: 1

    ... to prevent Microsoft, its employees, and agents from using code covered under the GPL?

  15. Logans Run on Should Open Source Software Expire? · · Score: 1

    Its not Blade Runner...

    Anyway, very bad idea, because the savy would comment out this check.

    I still run an older version of because patching it also means completely upgrading the version of linux on the remote P120 with 48M RAM it is on... I dont want to go through that pain.

    B.

  16. Re:Easy to break. on Practical Quantum Cryptography · · Score: 1

    If I may cut and paste a bit o' text:

    "Los Alamos quantum cryptography uses photons randomly polarized to states representing ones and zeroes. Polarization refers to the direction of oscillation for the electromagnetic wave of a photon. These polarized photons are transmitted between sender and receiver to create a random string of numbers known only to the sender and receiver. This string of numbers becomes a quantum cryptographic key that locks or unlocks the encrypted messages that are sent via normal communication channels. Because the photons cannot be intercepted without tipping off the receiver, the quantum cryptographic key is secure and the data is secure."

    So, what is the crux of the security... "Photons cannot be intercepted without tipping off the receiver..."

    Really? So man in the middle cannot happen; let's just accept that on blind faith, and quantum cryptography will work. Now, never really believing in blind faith, lets think about how we can be man in the middle without tipping off the receiver, or how about who cares if we do. Don't think about the theory; its not as important as the application.

    I drop fibre between A and B for key generation. I turn the magic switch and let the no key sync take place. WTH I just noticed my data is bad. A and B reset. How do I know I am still directly communicating? I jump through a bunch of hoops to make sure my twin is who I think it is and not some doppleganger... now the security is in your authentication/restart procedure, not the theory.

  17. Re:Similar thing happened to a friend of mine. on Practical Quantum Cryptography · · Score: 1

    On a serious note...

    I really want to be specific. The problem is, and this isn't a cop out, we all signed serious non disclosure agreements. If I disclose specifics about the technology we worked on, or how we got ourselves fired, our former client would immediately know who we were and I have absolutely no doubt I'd have the wrath of a public company on my ass claiming massive damages.

    Let's just put it down to me being clueless and obviously not understanding how it works. "It is easier to discount than to disprove."

    Have you ever noticed how many companies involved in security have more lawyers employed than software developers?

    M.

  18. Easy to break. on Practical Quantum Cryptography · · Score: -1, Flamebait

    This is amusing.

    I knew a dude who started a quantum .com, and a dude who was contracted to "write the software." During the course of developing the software, it became completely obvious that
    1) quantum crypto was good for random number generation
    2) " " was bad for encryption

    The theory is that bouncing messages, throwing in noise, and using transmission latency entropy you could get keyless exchange... the reality was (according the guy who was writing the software who was summarily fired when he provided an example of how it could be broken) it still is prone to man in the middle.

    I put quantum encryption up there with the rest of the dot com snake oil.

    "I have a cure for the common cold! Give me millions to bring it to market and make you investors rich!"
    "Ok, great, let's do it. Oh, by the way, what is the cure?"
    "Its a highly advanced constriction system that is placed over the aspiratory orifaces that eliminates the environment virii or bacteria require to propagate."
    "Hmm... looks like a bag."
    "Its made of world class, space aged, hydrocarbon based materials! We have patent pending."
    "Hmm... a plastic bag. Doesn't it kill the patient?"
    "We don't see it that way. We prefer to think of it as 100% effective in eliminating the root cause."

  19. It might work... on MS: Use the Source, Luke! · · Score: 1


    Microsoft has always done this. Microsoft gives discounts, often significant discounts, on software to sales people and academics. I remember buying word and excel for $50 each.

    Microsoft killed WordPerfect at the university I attended by "giving" the software away to departments. At first it was a political battle; but how can you argue free vs expensive and archaic?

    The problem is; open source and java are powerful and [mostly] free. Microsoft will never open its Kimono, but they WILL give away DevStudio and other development and management tools; in addition Microsoft WILL give away reference materials. You'd be surprised how many people still like to have books...

    Given a choice of a nice commercial IDE and VCS system over a free yet quirky one - I'd go with the nice commercial ones.

    (Another side point; most professors are easily bought. Many, many, many "grants" to do research are doled out by Microsoft with the catch that Microsoft tools are used. Again, at my U, I saw these documents, and they worked, because 90% of professors are there for the research, and government funding does not even come close to corporate sponsorships.)

  20. Re:Ageism and Forced Lying on Apple Cuts Off Under-18 Darwin Developer · · Score: 1

    This is a common argument with a common response. Law X discriminates against Y because of Z. Law X does NOT discriminate for the general case for the common good. Here is the example; anyone consider over the age of 18 is an adult. Real discrimination comes if one 17 year old is considered an adult, and another is not. Then it would be analogous to racisism, classism, or gender based discrimination.

    The problem is always where to draw the line. Evaluation on an individual basis is not practical, and arguably, fair.

  21. Re:Ageism and Forced Lying on Apple Cuts Off Under-18 Darwin Developer · · Score: 1

    Dictionary definitions of discrimination do not apply in this context. A juvenile has no rights under most western law, in fact, juveniles are interpretted as property. A juvenile is usually defined as a person lacking the cognitive skills to conduct themselves appropriately in "adult" society; that is make rational, reasonable, decisions in accordance with the law, and the ability to enter into binding agreements. Most of the corpus iuris civilis upon which our laws are based are related to property. That is why parents are guardians of their children, and bare sole responsibility and accountability until the child comes "of age". A child cannot enter a binding contract without the guardian jointly entering the contract because 1) the child has no rights and 2) the guardian is solely responsible for the actions of the child.

    There is also the point that Apple can have whatever constraints in its contracts it wants, and ALL the signor can do if he doesn't like the contract is ... not enter the contract. Apple is fully within its rights to cancel a contract made under false pretense AND seek remedy. Apple is within its legal rights to go after this kid's parents for damages (assuming it can prove damages.) It can request that all materials be returned to Apple. It can easily get a court order to sieze materials related to this breach.

    From what I read, from this kids web sight, Apple is being quite generous by following its policy and NOT going after him for perjury, that can have significant penalty depending on the state.

    What is particularily amusing is that Apple is also within its rights to ammend or modify any contract as it has done for under-aged in the past. Did the kid even CONSIDER asking Apple to modify the contract with respect to his age, OR did he just exercise poor judgement and lie?

    Actions speak louder than words...

  22. Re:Ageism and Forced Lying on Apple Cuts Off Under-18 Darwin Developer · · Score: 2, Interesting

    This is not an issue of discrimination, and I would argue that stating that you are being compelled to lie only illustrates you are not mature enough to grasp the issues around contract law and exactly the reason why issues of responsibility and accountability are denied to you. I have heard this arguement so many times; for example, I am a kid so I cannot afford to buy software so I am compelled to pirate it. You know you are purgering yourself, and you know it is wrong, so you are expressing the "will" to do it anyway. Law makes a big deal about this little issue.

  23. You must enter your age to get ADC... on Apple Cuts Off Under-18 Darwin Developer · · Score: 1

    Apple has always required you be "of age" to be part of ADC or the seed programs. And they are exactly right; if a minor violates the agreements it is impossible to prosecute them. The easy way out is for the defendant's lawyer to say "they are too young to understand the terms of the agreement." One could argue by LYING on the form, it illustrates the character and/or maturity of the individual purgering themselves.

    Death to smoochie.

  24. personal measure on RIAA Almost Down To Pre-Napster Revenues · · Score: 1

    I agree with some of these statements based on my own habits.

    I was late on the Napster band wagon, but my music buying increased as I would hear a tune on the radio (or get nostalgic), snag it, then snag another tune, and if I liked a few tunes from an album I'd get it from Amazon. When Napster died, I tried a gnutella client (BearShare). It was more difficult to find stuff, so I just stopped using it.

    The correlation is, I have stopped buying music. With Napster, music consumption was almost addictive. I've gone from $200/mo in purchases to... NOTHING. And it has nothing to do with the economy. It has everything to do with CAVEAT EMPTOR. With all the crap getting pushed out by the music industry, and the price-point valuation of CDs, I don't feel like gambling $10-20 for something I can't try before I buy.

    I found my music interests were getting pretty broad too. I hear Chicane, Moby, Vertical Horizons, Rammstein... and bought them all (even different albums by same artist) because I heard a few tunes. I even bought new albums by old favorites like Alphaville, not because I download the song, but because I noticed there was a new album.

    Well, that's my measuring stick. I thank the various Machts for saving me money...

  25. possession of buglar tools on Is The Net At Fault For Illegal Filesharing? · · Score: 1

    The argument is the same for a person who was a key for a place the aren't supposed to. It's all about intent. The problem is the anti-piracy advocates are going after the people that make the keys. Their argument is the software facilitates a slim jim (or lock pick) and why would anyone have one without intent [to commit a crime]? Of course the answer is, arrest all the lock smiths and tow truck drivers out there that help you when you lock your keys in your car. Does [Napster] facilitate piracy? Why yes. Does [Napster] promote piracy? Why no. People who have the intent had this intent before they had the tool. Same goes for TiVo blah blah blah or anyone with a cassette recorder or VCR.

    Any protection can be broken. Any media can be duplicated. Is the cracker or copier doing anything illegal? Only when they distribute - that is - violate the copyright - that is deprives the holder of potential income.

    Because I can buy a crowbar, does that prevent someone from selling me a house?