Slashdot Mirror


User: swillden

swillden's activity in the archive.

Stories
0
Comments
18,006
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 18,006

  1. Yes, but some hipster is going to complain that having to be asked to decrypt every message is cumbersome and not as cool.

    And that still wouldn't help. Because how would anyone (hipster or not) decide whether to decrypt the message? The only information you have before the message is decrypted and displayed is the subject and sender, and the attacker will arrange for both of those to be things you'd expect to be legitimate. The attacker is someone who can intercept and modify your legitimate email, remember.

  2. More like "Stop using the automatic door unlocking tool".

    Yeah, but it's more like, "Don't have your automatic door unlocking tool automatically unlock any door that any random stranger might send to you."

    Like you said, the analogy doesn't work.

    Right, but most email clients with S/MIME or PGP support do automatically decrypt and display any email. You have to click on it first, but why wouldn't you? Obviously the attacker would make sure the From and Subject fields contain values you'd expect to see... probably just use the ones from the email they intercepted and modified.

  3. Re:It's the "per month" thing that gets me. on Google Will Make Its Paid Storage Plans Cheaper (theverge.com) · · Score: 2

    $10 a month is $120 per year. Since hard drive storage only costs about $25 per TB to actually buy one of those 2 TB, 3 TB, or bigger drives, they break even on the storage costs at about 5 months.

    You mean 12 months. A 2TB drive costs $60, but since you aren't an idiot you don't buy just one, you buy two because you need one copy offsite. So you back up locally to one of them, then periodically run over to your mom's house (or wherever you're storing your offsite copy) and swap them. I'm assuming you don't need to include any allowance for your time because you're good and visit your mom regularly anyway. And I'm assuming you are methodical and not lazy and so always remember to do this drive swapping.

    Personally, $100 per year (including the discount for paying annually instead of monthly), makes perfect sense for me. That's without even considering electricity or maintenance (drives are low maintenance until they fail).

  4. "Don't go sticking your key into unknown locks."

    More like "Stop using the automatic door unlocking tool". The analogy really doesn't work, but the point is that if you continue automatically decrypting emails with a buggy mail client, an attacker can arrange to be able to read emails encrypted to you.

  5. Re:Of course on Google Employees Resign in Protest Against Pentagon Contract (gizmodo.com) · · Score: 2

    They were all in when it was a creepy private data mining operation

    Have you considered the idea that perhaps Google employees are actually reasonable and privacy-conscious people, and that they're okay with what Google does because they see in detail exactly how it works and find it pretty harmless and a reasonable trade for the value of the services provided? You're making worst-case sort of guesses (which is reasonable) and assuming that what you're guessing is the same as the reality that Google employees see.

    FWIW, I'm a Google employee who is a long-time crypto security engineer and privacy advocate going back to the days of the old cypherpunks mailing list. I operated a remailer for years and now operate a Tor node. Inside of Google I see how the security systems are structured and how policy is applied to protect user data, and I'm generally quite comfortable with it. Google does a good job of securing user data against leaks, fights back hard against government access to data, makes responsible use of data in reasonable and non-harmful ways, is quite clear and up front about the fact that you are trading data for targeted advertising in exchange for the Google services you use (which are generally of quite high quality and value), avoids collecting or storing data that isn't relevant, and generally tries to do the right thing for users. That's not to say there are never any missteps or mistakes, but they are viewed as mistakes and are corrected.

    I'm not saying that you should believe me or agree with me. That's your call. But the above is my honest perspective based on what I see. I'm cognizant of the fact that I am biased by my (very nice) paycheck, but I believe I'm reasonably objective.

    FWIW, I also have no problem with Google working on military projects. In fact, when it comes to stuff like the application of AI to warfare, I would rather Google do it than another company, because it is an ethical minefield and I think Google is more concerned about the ethical implications than many other companies, mostly because Google has massive cash flow which provides more freedom to refuse to do unethical things. To people who have decided that their assumptions about Google's allegedly evil behavior are gospel truth, that last sentence seems insane, I'm sure. But those people should realize that they're basing that opinion on unsubstantiated assumptions.

    Anyway, I think these people who are resigning are silly and wrong. But I'm a former soldier, so I'm sure they would find my opinions distasteful. That's cool; we don't have to agree on everything. I'm sad they feel the need to leave the company, but I respect their integrity.

  6. Re:Psychosis / Mass Psychosis on Reporter Shares Experience of Visiting a Flat Earth Convention (vice.com) · · Score: 1

    The christian bible has been used for just as much justification of violence as any other.

    Not at much as "Das Kapital", or "Mein Kampf". Religions are often used to rationalize violence, but the real reasons tend to be quotidian. Utopian ideologies, on the other hand, are truly dangerous.

  7. Re:Science is an error-correction process on Earth's 'Bigger, Older Cousin' Maybe Doesn't Even Exist (npr.org) · · Score: 1

    Utter nonsense. There are always errors in scientific work. In fact, much of the detail work in science is exactly identifying and controlling for errors... and it is not always done perfectly.

    Wrong. The science is settled. The raw temperature data sets were perfectly adjusted downward for the past in conformance with our perfectly accurate models.

    There is nothing more to discuss on the matter except legislation and how we need more funding.

    Complete and utter nonsense.

    Oh, the fact that anthropogenic global warming is a serious risk that we must address immediately is quite clear. We should be imposing carbon taxes, funding research into fossil fuel alternatives, and also researching more aggressive schemes for carbon extraction and sequestration and global cooling, perhaps by blocking insolation (because merely slowing -- or even stopping -- our dumping of CO2 into the atmosphere is not enough.)

    BUT anyone who believes that we fully and completely understand the planet's climate is an idiot. It's an enormous, and enormously complex system, and we have barely scratched the surface. Our models will change as we refine them. More measurement errors will be found and corrected. That doesn't mean it's likely that any of this error correction will cause us to decide AGW isn't real, or isn't really a problem, nor does it mean that we shouldn't be acting aggressively on the best information we have, but there are errors and we do need to continue doing the research to find and correct them.

  8. A human would give the correct answer - or at least go "Uuh? What's that got to do with anything?" A robocaller would politely say "I'm sorry Sir, I'm not sure I understand your question..."

    Actually, the latter is exactly what I'd expect a human customer service agent who hasn't read Douglas Adams to say.

  9. Re:Science is an error-correction process on Earth's 'Bigger, Older Cousin' Maybe Doesn't Even Exist (npr.org) · · Score: 1

    You said the same thing I did, in different words. I'd have thought that you were just agreeing with me, except for your line about my position being self-contradictory. I'm confused.

  10. Re:Science is an error-correction process on Earth's 'Bigger, Older Cousin' Maybe Doesn't Even Exist (npr.org) · · Score: 2

    Well reasoned.

    I suggest the mechanism by which we (in the West, at least) enjoy the wealth, comfort and plenty in which we live, as compared to the poverty, hardship and scarcity in which our ancestors lived, is not because of science per se but because of easy access to fossil fuels.

    Bah. Science gave us a lot of progress before we began using fossil fuels, and is providing alternative energy sources, as well as methods to be more efficient, for after we stop using them.

  11. Re:Science is an error-correction process on Earth's 'Bigger, Older Cousin' Maybe Doesn't Even Exist (npr.org) · · Score: 2

    Utter nonsense. There are always errors in scientific work. In fact, much of the detail work in science is exactly identifying and controlling for errors... and it is not always done perfectly. Also, the value of peer review and replication is to provide opportunities to identify and correct errors in the original work. If it were possible to do perfect work, that wouldn't be necessary.

  12. Re:Seems Google doesn't check anything but your em on Malicious Apps Get Back on the Play Store Just by Changing Their Name (bleepingcomputer.com) · · Score: 1

    if you got the sizes right you should do a pretty fair job that would have very few false negatives. and not too many false positives.

    Maybe, maybe not. You're making a lot of guesses -- which isn't bad unless you start assuming that your guesses are guaranteed to be right. In fact that's pretty much how this space works; people guess at what might work, evaluate the data, then try it if it looks promising. it's entirely possible that something like this was tried and found not to work as well as you're guessing it would. I know the people on the malware scanning team and they're very good. I know this example looks bad, but the problem is a lot more complex than it appears.

  13. Science is an error-correction process on Earth's 'Bigger, Older Cousin' Maybe Doesn't Even Exist (npr.org) · · Score: 5, Insightful

    The fundamental thing that everyone should understand about science -- and most people don't -- is that science is nothing more and nothing less than an error correction process.

    Everything we know is wrong, at least in some way and in some degree. Science is the process by which we identify errors and fix them, but science is itself an error-prone process and all scientific results are erroneous, at least in some way and in some degree. The fact that errors are discovered is not evidence that science doesn't work, it's evidence that science does work, that it identifies and corrects humanity's errors -- including those generated by previous science.

    What makes science works is that although we always introduce new errors in our understanding when we correct old errors in our understanding, the new errors are nearly always smaller. We approach the truth iteratively and asymptotically, getting ever closer but never arriving.

    And if anyone ever tells you that science is pointless because scientists "keep changing their minds", you need only point at the wealth, comfort and plenty in which we live, as compared to the poverty, hardship and scarcity in which our ancestors lived, just a few generations ago. The fact that science has not yet achieved perfection doesn't mean it doesn't work, it just means it's not yet done (and it will *never* be done; there will always be more errors to correct).

  14. Re:Seems Google doesn't check anything but your em on Malicious Apps Get Back on the Play Store Just by Changing Their Name (bleepingcomputer.com) · · Score: 2

    They failed at an even simpler level than that. They could have just kept checksums of the code objects in known malicious apps and automatically removed any other apps that match that checksum

    Since the name is part of the package contents, changing the name will change the checksum. For that matter, just re-signing the package (even with the same key, much less a different key) will change the checksum. Your very simple countermeasure couldn't actually work at the package level. It might work at a lower level, disassembling the package and storing checksums of individual .class, etc. files, but the naive approach would produce a lot of false positives, because Android apps (including malicious ones) often contain library code. It would be possible to build a system that could distinguish common libraries from other code and minimize the false positives... but it wouldn't be trivial to do at scale, would likely always generate some false positives, and would be very easy for malware authors to defeat since they'd only have to change one byte of their code to break it.

  15. and as a service Google can take steps to minimize abuse.

    Which steps would that be?

    Oh, maybe noticing when a business is being flooded with calls and refusing to make them?

    We haven't been able to solve the issue of spam, despite trying for 25 years. What makes you think those mysterious "steps" would be any more successful?

    The thing that makes spam hard to address is the decentralized nature of SMTP. If all email originated from a single system it would be easy.

    The verification would be a credit card number

    a) check b) check c) well, since you absolutely can't get such a number anywhere unless you are the rightful owner of said card...

    And yet this isn't a significant problem for hotels and restaurants that already do this. The exact reasons it's not a significant problem are complex. If you really want a lecture on how the credit card fraud mitigation systems work, I could provide it, but I think it's adequate to point out that if the issue you're positing were real, it would already be a bigger problem than it is. (Which isn't to say that it's not a problem, but it's a manageable one.)

  16. Re: Elon, do it some more! on Tesla Stock Plunged After Elon Musk's 'Bizarre' Conference Call (wired.com) · · Score: 1

    I am one of the non-zealots who is not a Tesla M3 owner at this point.

    So... just guessing.

    Let's wait awhile for regular people to use it to find out if it's accepted.

    How long do you think we need to wait? The Model S has been on sale for six years now and has sold over 250,000 units.

    I only commute 2.7 miles to my new job. An electric bicycle is starting to seem attractive. A Tesla is out of the question.

    I commute 0 feet to my job (my office is attached to my bedroom). But I don't stay home all the time.

  17. Re:Scuba Divers know on States Turn To an Unproven Method of Execution: Nitrogen Gas (nytimes.com) · · Score: 1

    How about a method that doesn't dump a bunch of trash in the ocean? The fish will take care of your bloated carcass, but what about the unattended ship(wreck) and diving gear? What a waste of a perfectly seaworthy boat.

    The boat would be found right where I anchored it, and quickly taken by some enterprising islander. The dive gear would lie at the bottom of the 6000-foot wall, true. I considered the notion of rigging something to refloat my corpse and gear, but wouldn't want to give some poor person a bad day when they find me. Perhaps there would be a good way to detach the gear and refloat it, something triggered by reaching, say, 2000 fsw. A lift bag and a way to trigger my octo into it at depth would work for refloating, but I'd also need a good way to detach my BC/tank. I use a weight belt rather than integrated weights, so the weights would keep me going down. Of course, the lead weights and canvas weight belt would end up at the bottom, no way to avoid that without refloating my corpse. Well, not unless I could come up with a way to detach the belt and trigger a lift bag after a few days of resting on the bottom.

  18. Re:it's an oxygen deprivation chamber on States Turn To an Unproven Method of Execution: Nitrogen Gas (nytimes.com) · · Score: 1

    Yes, you were correct. I was just highlighting the fact that breathing N2 doesn't merely stop providing O2, leaving you O2-less when you use up what's dissolved in your blood, it actually pulls O2 out of you, resulting in instant and severe deoxygenation.

  19. Re:Scuba Divers know on States Turn To an Unproven Method of Execution: Nitrogen Gas (nytimes.com) · · Score: 2

    Inert gas narcosis on air/nitrox doesn't become a significant concern until past 4ata / 100fsw. For air that's a PPN2 of 3.12. Breathing 100% N2 at 1 ata wouldn't even remotely induce any type of narcosis.

    If you want the prisoner to enjoy his execution, you could put him in a hyperbaric chamber and pressurize it to about 6 atmospheres, then replace the gas with pure N2. PPN2 would go from 4.68 (moderate narcosis) to 6 (strong narcosis), as PPO2 went from 1.26 to 0.

    As a diver, I've long said that if I'm diagnosed with a painful or debilitating terminal disease that leaves me sufficiently healthy for a while, I'd spend time with family until I got to just before the point that I didn't want to live any more, then I'd head for Little Cayman where I'd buy a boat, drive myself out to Bloody Bay wall, gear up and drop slowly into the abyss, enjoying the fish, then the narcosis, until I lost consciousness and died. Can't think of a better way to go.

  20. Re:Dr Kevorkian on States Turn To an Unproven Method of Execution: Nitrogen Gas (nytimes.com) · · Score: 2

    You don't even notice how quickly you go under because you think you're getting air all the while there's nothing in your lungs to help Oxygenate your blood.

    It's worse than that. If your breathing gas has 0 atm ppO2 (partial pressure of O2), your lung contents ppO2 is lower than the ppO2 of your bloodstream. This means osmosis pulls O2 out of your blood in an attempt to equalize the partial pressures of the gas on each side of the semi-permeable membrane. Of course, it also pulls CO2 out, so your body doesn't get the "I'm suffocating!" signal that high ppCO2 in the bloodstream signals.

  21. Re:it's an oxygen deprivation chamber on States Turn To an Unproven Method of Execution: Nitrogen Gas (nytimes.com) · · Score: 1

    Egads. Holding your breath doesn't flush the oxygen out of your lungs. In fact, it keeps it in there. Exchanging the oxygen in your lungs with 100% nitrogen quickly results in no more oxygen in your lungs (and body) having been replaced with nitrogen.

    More importantly, filling your lungs with 100% N2 causes your lungs to quickly remove all of the O2 from your blood. While holding your breath the O2 in your bloodstream declines only as you metabolize it (and does get somewhat replaced by free O2 in your lungs). If the ppO2 (partial pressure of O2) in your lungs falls below the level of O2 in your bloodstream, your lungs will actually be pulling O2 from your red blood cells so you can exhale it. If the ppO2 in your lungs is zero, this happens very quickly. And, of course, it's a short path from heart to brain, so within seconds your brain is filled with deoxygenated blood.

  22. If you have access to such a system, and I'm certain they will make it generally available... These systems are disruptive, and I haven't seen anyone thinking about solutions to that so far.

    You are assuming that no one has thought about it, and that assumption makes you assume that Google will make this generally available. It's far more likely that Google will not make it generally available because they have thought about it. It's just as saleable as a service (perhaps more profitably, actually), and as a service Google can take steps to minimize abuse.

    They will have to answer with verification systems, which a) makes everything more complicated for us actual humans and b) adds a small overhead and c) just starts the arms race we already know from IT security.

    Even if this did happen, it wouldn't be an "arms race". The verification would be a credit card number, and the restaurant would hold a reservation fee which wouldn't be completed unless you didn't show (or could be fully charged at point of reservation and deducted from your bill when you eat). This would indeed be more complicated and add a small overhead, but no arms race. Restaurants would set the fee high enough to deter fake reservations, and that would be the end of it. It wouldn't be unprecedented, either, because some high-end restaurants already do it.

  23. Re:It shouldn't matter if they're gambling or not on EA Still Believes in Loot Boxes, Will 'Push Forward' With Their Use (variety.com) · · Score: 1

    You should have finished reading my post. It wasn't long.

  24. Who cares if the books had other silliness?

    This one point stands just fine on its own. Mathematically, if each generation is 50% of the size of the previous generation, then you double the starting population and hit a stable limit. This isn't an argument that depends on the authoritative statement of the author, it's a simple mathematical fact. Why bother attacking -- or even considering -- the source when the source is so clearly irrelevant to the validity of the idea?

  25. Re:Jesse James... on EA Still Believes in Loot Boxes, Will 'Push Forward' With Their Use (variety.com) · · Score: 1

    All criminals believe their crimes should be legal: this way they wouldn't be prosecuted for doing them.

    No. Criminals would like to get away with their crimes. That's different from honestly believing they shouldn't be illegal.