Slashdot Mirror


User: Soko

Soko's activity in the archive.

Stories
0
Comments
970
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 970

  1. Re:All your whining finally lands on us... on IE6 SP1 Will Be Last Standalone Version · · Score: 4, Insightful

    *Backs up the truckfull of troll food*

    I've always said it, and I always will, the community's incessant bitching about how insecure microsoft is has led to attrocities in design.

    If security was designed in from the start, the design should be elegant and transparent to the end user.

    Example: Windows file protection - to avoid DLL Hell. DLL Hell was pure and simple bad user habits (running in Administrator mode etc etc). So they made a system that completely bypasses security, and disallows everyone on your system from changing files... even administrators. It's a travesty, that's what it is.

    That actually was a response by MS to programmers who felt like using a specific API in a specific DLL, of felt they could just over-run Microsoft's designs willy-nilly. Remember, the most pervasive Windows out there is still the 9x series, not NT and it's modern kin. Most users are root whether they like it or not.

    Well, here we see another travesty: because of simple HTML script exploits, which under normal circumstances (ie, if you weren't running as admin) would have very little consequences, Moft has come up with another travesty, has introduced 'state' into what should be stateless... And as a result, I just can feel the hours and hours of headache that is now set upon us programmers, for the rest of time.

    Two issues:

    1 - Once a machine is compromised as any user, there are other ways to elevate privileges. IOW, runnig as admin usually has little or no effect to a serious cracker.

    2 - If the security mechanisms are properly designed, you won't be spending "hours and hours" dealing with security. If you are, Microsoft will have done a piss-poor job (again)

    I can clearly recall posts on slashdot, (but to be fair: /. isn't the only guilty body, every bitchy tech writer of the times is), saying how IE had too many priviledges.

    What is supposed to be and end user application is an integral part of the OS. Sounds like a recipie for exploits to me. Unless of course they implement stringent secutiry mechanisms.

    All I have to say is BULLSHIT... IE has as many priviledges as the user running it - and as such, just as many, not any more than Mozilla running at the same user level.

    But Moz isn't part of the OS. BTW, IIRC, IE (specifically MSHTML) is loaded into memory before a user logs on. That means that that part of the browser requires system level priveleges. Mozilla's "turbo" mode (whatever it's called) requires you to log in first. See a diffrence?

    Now, because of that bitching, we have a 'lowered priviledge set'... something which isn't based on users... it's a whole policy scheme... It's introducing complexity where there is no need for any... Yadi yada... *Sigh*...

    Security is never easy, but it need not be complex. The one thing MS usually does well is make life easy on thier drone^H^H^H^H^Hdevelopers (right, Mr. Ballmer?), so you may have an easier time that you think. Unless you're so used to security as an after thought, that it does become a pain. IMHO, that puts you squarely in the "Part of the problem" camp.

    Boo on everyone.

    No, shame on you for not wanting to have to do any work at all in order to have secure code.

    Soko

  2. Re:Does this remind anybody else of the Jerky Boys on SCO Might Sue Linus for Patent Infringement? · · Score: 5, Funny

    ...questions about possible lasuits (all ridiculously frivolous), dragging the lawyer further and further into the realm of stupidity, then..."

    This typo is strangely appropriate. As in:

    "SCO is really in la-la land."

    or...

    SCO: "NO! Our source! I don't care about what Novell says, OURS!"
    Novell: "Look in the agre-"
    SCO: *plugs ears* I CAN'T HEEEEAR YOU! LALALALALALALA....."

    Should be added to the Jargon File or something:

    lasuit (lô' soot) n : A litigation over Intellectual Property based on ridiculously frivolous grounds, dragging the complaintant further and further into the realm of stupidity. See: SCO.

    Soko

  3. Re:By 2880 on Simulation Of An Asteroid Impact In The Year 2880 · · Score: 1

    ..this UCSC computer simulation will be as high tech as a 2880 refrigerator magnet.

    However, they'll both do the exact same thing when they discover such an object approaching the earth:

    "Yo, human. Bend over and kiss your ass goodbye."

    Soko

  4. Re:Phoenix, meet dd on Phoenix Unveils Anti-Theft BIOS · · Score: 2, Insightful

    OK, so they manage to kill the origional hard disk. What about the copy of the rest of the FS I have in a binary image, with no HBA involved?

    Sorry, this isn't a deterent to people who have more than a trivial interst in the contents of a stolen hard disk.

    Soko

  5. Phoenix, meet dd on Phoenix Unveils Anti-Theft BIOS · · Score: 5, Interesting

    "Since TheftGuard's also in the BIOS, even if you remove the hard drive, we can still track or disable the machine, or wipe the drive," he said. Another trick that can eradicate anti-theft software -- running FDISK to reformat the drive -- also is foiled by TheftGuard's place in the HPA section of the hard drive, which is immune to simple reformatting tools.

    Any hard disk forensics person will tell you the wonders of dd and netcat working together. Adjust the dd parameters a tad, and the HBA is no longer a problem. If they think the bad guys don't have access to this knowledge, they're as FDISKed as they seem.

    This is seriously stupid, so it must have come from marketing, not the techies.

    Soko

  6. Re:Murphy's Law on Phoenix Unveils Anti-Theft BIOS · · Score: 4, Funny

    Remember, Murphy was an optimist.

    I'll wait for the first virus that activates this feature while spoofing the HW address.

    "Help, Phoenix, I've been STOLEN!!! Nevermind that guy I've got in chains and a gag, BLOW THIS PLACE UP!! NOW!!!"

    *BLAM*.

    One less Windows XP install in the world. Then again, this might be very useful as a LART...

    "What was you machine's name again? *Clickety-click*

    Soko

  7. Re:Again and Again on MS Tweaks Ill-Received Licensing Plan · · Score: 2, Insightful

    I'd really like to know just what would be considered a positive for/from Microsoft around here. Really. What would it take for them to get an iota of respect beyond Gates saying that he runs Linux at home?

    How about the following:

    - Work with others in the industry instead of trying to destroy them at every turn. There's lots of business to go around.
    - Stop being so fucking paranoid about Windows/Office. Make Windows 'play nice' with everything else out there, or show people how to make it 'play nice' - for free. Microsoft doesn't have all the best ideas all the time.
    - Follow standards like they were law. If they find a better way, propose changes to the standard with no IP strings attached.
    - Try to compete on technical merits and value, not on spin and conjecture. IOW, stop paying attention to the faults of others, pay attention to the faults that you yourself have.

    I'm sure I'll come up with more later. Right now I'm too busy tring to get this VIA ITX board to play DVDs properly in Linux to bother.

    BTW, I have no great hatred of Microsoft - they do make some good stuff. It all goes bad when they try to help the Marketing Dept. out in what should be purely technical. If the MS developers could shoot the MS marketroids when they came wandering in to the development meetings, I bet things would be a lot better. Hell, I'd even take a job there then.

    Soko

  8. More Materials to start with on Getting Started in Network Security? · · Score: 2, Interesting

    All very good for the beginner, for sure.

    Don't forget tripwire, nmap and Nessus. I find Nessus particularly interesting, especially if you have more than a modicom of network experience under your belt.

    I think security is the one area of the IT industry that's growing. Thanks, Microsoft!

    Soko

  9. Re:ok on Recycling Parts From Dead Motherboards · · Score: 1

    Basically, it's a frequency generator. Produces square-wave voltage signals at a frequency set by the buttons and shown on the display.

    Good for prototyping logic circuits, etc.

    Soko

  10. Re:Keep hacking and keep building web pages on Recycling Parts From Dead Motherboards · · Score: 1

    Even though I'm at a point where I can get free samples of nearly anything I want, there's nothing like having the part you need when you need it.

    Thus spake McGyver.

    Seriously, I consider myself a graduate of "The School of Match, Patch and Blend". If I don't have what I need, there's usually something around that I can make work until I can get the proper parts. I once actaully saved a project dealine by repairing a PC with paper-clips and elastic bands. No, I'm not kidding - there was no where I could get proper motherboard stand-offs at 10pm, so I made do.

    Having an old, dead PC around at the time would have lead to a much more professional (and not nearly as scary) repair.

    Soko

  11. Re:Great Ice Wine - Contradiction in Terms? on Wireless Wine Monitoring · · Score: 2, Informative

    Yes, this stuff is rather thick (for wine) and super, super sweet. It's intended to be that way too - it's considered a desert wine.

    IceWine grapes (Reisling or Vidal) are optimally picked when the temperature first drops to -9C - that's when the freezing perfectly concetrates the sugars in the juice and produces the best flavour balance. IceWine is produced by most vintners in Canada, since it sells very well at rather high prices, and it's not uncommon in Canada's wine regions to have a summer exactly like Bordeaux and a winter like Siberia - perfect for making scads of the stuff. I'm not much of a winer myself, but I've had several excellent bottles from the region as of late.

    I live in Niagara, which is the other Canadian wine region (the story is about a British Columbia vitner), and a lot of the tourists love IceWine. You can learn more about Niagara wines at the Ontario Wine Route website.

    Soko

  12. Re:Illegal things... on Blow the Whistle, Lose Your Job? · · Score: 1

    Think like a lawyer for a second. *ouch* Sorry. ;-) Anyway...

    If your employee knew you had policy that said the following (or something close):

    "Accessing pornography, hate mail, *insert other poetntially distasteful Internet content here* is expressley forbidden. Any employee that willfully engages in these activities will be Dismissed with cause..."

    When they sign the paper that says they've read and understood that policy, you have essentially put responsibility for the content they access on them. IANAL, and some jurisdictions may vary, but where I am this policy works.

    No one would (or should) get fired over getting scores on the game, but putting thier employer at significant legal risk should carry an equally significant penalty.

    Soko

  13. Re:Illegal things... on Blow the Whistle, Lose Your Job? · · Score: 5, Insightful

    I agree with you whole heartedly.

    Though out of work at the moment, I have in the past drafted company policy regarding things of this nature.

    I always made sure that employees understood that the workstation they sat at was the property of the company and to be used for company related business only. I made certain they understood that they were not to use resources as though they were connecting via an ISP, (I helped many people connect to thier ISPs mail system in order to recieve personal messages - I'm not heartless, just professional) and that the company viewed activities of this nature very, very seriously. "Dismissal with cause" was used very often in the wording of the policy, and "seek Legal remedies" was used once or twice as well.

    Most people don't realise that even viewing questionalble content with company resources, (But I didn't "download" it, I just looked at it!!!) leaves the company open to legal issues ("Know what a proxy is Bob? How about your browsers cache, hmmmm?) since the file ends up on the comanies system somewhere.

    Executive summary: Things like this should be a matter of policy, and made known to each and every employee the day they're hired before they even touch a keyboard.

    Soko

  14. What I wrote... on Online Newshour Tackling Digital Copyright · · Score: 2, Insightful

    Good evening, gentlemen.

    Firstly, I don't download music, nor do I share my CD collection on-line. Downloading content I haven't paid for, or that isn't given to me by the rightful copyright owner, in my opinion is wrong to do.

    That being said, I also believe that the "technological cat is out of the bag", so to speak.

    I haven't bought a CD in over 2 years, since they are outrageously priced, and there just hasn't been anything out there that I feel warrants such an expense. There have been a few songs that I wouldn't of minded getting, but I would be paying the full CD price for a song or two. I have spoken to many, many people who feel the same way - not enough quality content to justify the full price of a CD. Add to this the onerous copy protections that the Industry wants, their seeming hatred of Fair Use doctrine (I have each of my CDs backed up in MP3 format on 2 separate computers in case the origionals are damaged in some way), the well known fact that very few artists actually make money from the sales of CDs and the way the RIAA has tried to stifle technological advances, you end up with many, many people who are angry at the record companies and feel justified in acquiring thier content via P2P networks. This trend started quite a few years ago, and since the music industry did little to re-close the bag back then - by addressing what thier customers now wanted, not how to prolong the status quo - the cat left.

    Sharing of content is taken as a misdemenour at best, and an inherent right when you're connected to the Internet at worst. You are no longer serving your customers, you are fighting them. This being the case, any Economics undergrad can tell you that the current business model of the Music Industry is now fataly flawed.

    Seems to me that people are just voting with thier dollars. If it were easier and less expensive to acquire the content that customers of the RIAA actually wanted on a CD, rather than putting up with the hassles of downloading said content, this issue would just go away.

    Regards,

    Ron Sokoloski

  15. Re:When is X12 coming out? on Linux Desktop Without X11 · · Score: 5, Funny

    X12? Geez, I need to pay attention. I was waiting for XIII to be released...

    Soko

  16. Re:Sweet. on DVRs for Cop Cars · · Score: 2, Funny

    There'll be a black market for geeks to hack these things so the cops can switch them off and not be caught hitting on hookers for "favours".

    What? Some smart person would make them leave it on, so the boys in blue get a new revenue source. Internet pr0n generates lots of cash...

    Come to think of it, there's lots of way they could reduce the tax burden that way.

    - www.Rate-A-Ho.com
    - www.Catch-your-hubby-in-the-act.org
    - www.How-does-my-college-age-daughter-get-her-$BLIN G$.biz
    - www.Hugh-Grant-up-close-and-personal.net

    Soko

  17. Re:What "real world" applications??? on Lanlink Linking The Coasts · · Score: 4, Informative

    Read the last paragraph.

    Requirements - May not at any point attach to the real Internet. To be part of LL, a member must abide by any rules or guidelines laid out. In order for a project of this magnatude to work, there must be standards and rules followed.

    He's trying to set up a network, not an ISP. There are myriad reasons not to connect this project to "The Real Internet", both legal and technical.

    Your hope of open hotspots for WWW surfing and hacking etc. will likely go un-apeased by jumping on this network, unless of course it proves so popular that it becomes a "Second Internet".

    Soko

  18. Re:under linux there are no doubts: NVIDIA rulez . on ATI Radeon 9800 Pro vs. NVidia GeForce 5900 · · Score: 1

    ATIs drivers are by all accounts fine, as long as you've got a single screen. Dual head - that's thier Achilles Heel. Xinerama disables all 3D extentions on the ATI driver, and AFAIK they have nothing like NVidias TwinView. Not sure about the GATOS project drivers either, since I dumped my Radeon 9000PRO for my current GeForce Ti 4200 in order to run 2 screens. (UT2K3 demo runs sweer in a window on the second screen BTW)

    Hopefully they'll get thier act together. Competition is nice.

    Soko

  19. Re:You just know what will happen though.... on Electronic Paper Advances · · Score: 1

    Not the ultimate idiot, though.

    BOFH: "$LUSER, why is there white-out and hi-lite marker all over the e-paper I gave you?"
    $LUSER: "Ummmmm..." *BLANK_STARE*
    BOFH: "Thought so. I have to kill you now."

    Soko

  20. Re:"the Click-N-Run architecture..." on Michael Robertson of Lindows Responds · · Score: 4, Insightful
    Do you have the binary of Click-n-run?

    From the GPL FAQ:

    The GPL does not require you to release your modified version. You are free to make modifications and use them privately, without ever releasing them. This applies to organizations (including companies), too; an organization can make a modified version and use it internally without ever releasing it outside the organization.

    But if you release the modified version to the public in some way, the GPL requires you to make the modified source code available to the users, under the GPL.

    Thus, the GPL gives permission to release the modified program in certain ways, and not in other ways; but the decision of whether to release it is up to you.


    I read that to mean that you are only required to relese the source to those people you've released the binaries to, and it says nothing of making the source available to the general public (unless the binaries are as well, of course).

    In summation: Buy Lindows, install it and then you should be able to get the source to Click-n-run. After that, you can modify and re-distribute it to your hearts content.

    Soko
  21. Re:Possible Problem on Exec Shield for the Linux Kernel · · Score: 4, Informative

    Would a memcopy from the heap into executeable space be a fix?

    Perhaps even better would be to have your own "private" heap in userland. That would protect the OS, and you get to use your trick still.

    I'm not a coder by trade, so I can't really critisize what you're doing. I do understand operating systems and memory allocation therein though, so my admittedly uninformed opinion is that you're employing a somewhat dangerous hack here. The heap was not intended to hold executeable programs - you'd be broken on x86-64 as well. Using what amounts to a design flaw in a program isn't what I would be willing to call "good design". Might be better to come up with a different method - Ingo Molnar seems to think you do at any rate.

    Soko

  22. Re:Wow, what will they think of next... on Hi-Tech Weed-Killer · · Score: 1

    They already have.

    Though, given the state of my "lawn", I wouldn't call one of those a "Robotic lawn-mower", I'd call it a "Robotic Weed Kille^W Mower".

    Soko

  23. Re:Hmm... on GPL and Leased Software? · · Score: 1

    IIRC, the GPL states that the source must be available for distribution, but doesn't specify the method(s) of distributing it.

    The distributor could create CD-Rs of the source to the device (or app) and then send a copy of the source CD-R only to any people who actually ask for it - it isn't necessary to send the source at the same time as the binary.

    IOW, they are under no obligation to include the source code to the device to everyone who rents it, only to those who take the time to ask them for the source. IANAL and all, but that's how I interpret the legalese.

    Soko

  24. Re:SensorML on Moving Sensor Data Onto The Internet With SensorML · · Score: 5, Funny

    They could have justifiably named it Sensor Equipment eXtensible Markup Language. Imagine the FAQ for that one, though.

    Soko

  25. Re:Not the Tom Jones I was thinking........ on Baltimore Kinetic Sculpture Race · · Score: 2, Funny

    No? AAWWWWWWWWwwwwwwwww...

    /me skulks away when he realises there's no womens underwear about to be flung at the stage...

    Soko