Slashdot Mirror


User: sjmurdoch

sjmurdoch's activity in the archive.

Stories
0
Comments
73
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 73

  1. Re:GIMP plugin? on Photoshop Fails At Counterfeit Prevention · · Score: 3, Informative
    What I want is the Gimp plugin that adds the "Eurion Constellation" or whatever it is to my picture so that Photoshop won't open it.
    I checked this, and the "Eurion Constellation" is not in fact sufficient to get an imaged blocked as money. Also even images of currency that have had the "Eurion Constellation" removed are still detected as currency. It is not clear how this new currency detection works, but it is more complex than the "Eurion Constellation" test built into colour photocopiers.
  2. Webserver seems to be down - new links on Citibank Tries to Hush ATM Crypto Vulnerability · · Score: 1
    The Computer Laboratory webserver (www.cl.cam.ac.uk) seems to be down for unknown reasons.

    Mike Bond has made a temporary webpage The paper on the attack (UCAM-CL-TR-560) is also duplicated.

    These URLs are just temporary until the webserver is back up so could disappear at any time.

  3. Re:Government...been there, done that on Red Hat, Oracle to get Gov't Certification for Linux · · Score: 1

    SE Linux does provide logging, but you are correct in that is has not been certified nor are there any (public) plans to do so.

  4. Re:Government...been there, done that on Red Hat, Oracle to get Gov't Certification for Linux · · Score: 2, Informative

    The article in question was complete FUD. The NSA are still working on SE Linux along with open source developers. See this post from Russell Coker (one of the lead SE Linux developers outside of NSA), which mentions the official position of the NSA.

  5. Re:Thoughts on a more modern GUI on A First Look At The Xandros Desktop · · Score: 2

    X11 has great performance. Unfortunately, few toolkits use it well.

    Could you please tell us which toolkits use X11 well - this would be very useful for future reference.

    I've seen 10 boring apps written by people who understand X11 that perform 10 times better.

    Again any examples - preferably open source - I would like to try them out and see how they work?
  6. Re:Client side on SSH-Based Solutions - Looking for Industry Proof? · · Score: 2
    I would go back to Putty in a flash if it did port forwarding. Till then, ttssh for me.
    It does, and has done for some time. See the PUTTY documentation for more details.
  7. The letter I sent to my MP on Debate Postponed On UK RIP Act Amendment · · Score: 2, Informative
    Remember the discussion of the ammendment has been delayed until Monday 24th of June so there is still time to send a letter or fax to your MP.

    Here is the letter which I sent to my MP on Thursday. Feel free to use it for ideas for your own letters/faxes/emails but please, please do not just copy and paste significant portions of the letter into your one. This does more harm than good since then the MPs will just ignore both of them and think that you don't care about the issue enought to write your own letter.

    Mr Tony Worthington
    MP for Clydebank & Milngavie
    House of Commons
    London
    SW1A 0AA

    Dear Mr Worthington,

    I am writing to you to raise my concerns about the Regulation of Investigatory Powers (Communications Data: Additional Public Authorities) Order 2002 --- due to be debated in Parliament on Tuesday 18th June --- which permits additional agencies to obtain certain, otherwise confidential, information under the Regulation of Investigatory Powers Act 2000 (RIPA).

    As with many other people I was concerned by the introduction of the RIPA, due to the extreme powers it granted law enforcement agencies, in particular sections 21--25 which permits the Police, Customs & Excise and the intelligence services to obtain "Communications Data". Importantly, to exercise these powers a warrant is not required and their use is not subject to judicial oversight. While these powers may be understandable for the purposes of serious crime prevention, the amendment will greatly extend the number organisations which are be permitted the same power. Would the original RIPA act have been passed if the organisations proposed by the amendment were present in the bill?

    "Communications Data," as defined in the order, is more conventionally called Traffic Data. This includes the address and other data which is used by the communications system to transmit the message to the recipient. For example such information would include the list of telephone numbers called, from both mobile and ordinary telephones, the list of websites visited and goods purchased over the Internet, and the addresses of any email sent. In aggregation this information alone provides great power in tracking the behaviour of a person. Worryingly the same law also permits the location of anyone carrying a mobile phone, regardless of whether it is in use or not, to be identified to the precision of a few meters. This is due to the fact that mobile phone networks must monitor the location of handsets to allow a telephone connection to be made.

    Since no judicial oversight exists and other safeguards are almost non-existent, the opportunity for these powers to be abused is significant. Perhaps for this reason, the original act limited organisations to the Police, Customs & Excise and the intelligence services. However the order proposed will permit many more organisations to obtain this information. A list is included below, however it includes local authorities (including fire authorities), the NHS, the Food Standards Agency and even Consignia/The Royal Mail as it is a "Universal Service Provider". What legitimate reason have organisations like these to the information described above? Were a criminal act suspected then the Police should be consulted, who already have the power to obtain such information under RIPA and other acts.

    As previously mentioned no warrant is required, only the request of a sufficiently senior member of staff. The reasons by which this information can be requested are wide-ranging and include preventing/detecting any crime (regardless of how minor) or preventing public disorder, even "in the interests of the economic well-being of the United Kingdom". This is particularly of concerning since Consignia/The Royal Mail --- a commercial organisation --- is given access to information which extremely valuable and in many cases unavailable to other companies. The "economic well-being of the United Kingdom" would seem to permit commercial exploitation of this data.

    Since the powers provided by RIPA are already available to all organisations though the law enforcement agencies as part of a criminal investigation, there is no advantage to the public for this order to be passed. In fact the introduction of the amendment would be a significant infringement of civil rights and an unnecessary intrusion of privacy. Furthermore, the protections provided to personal data stored by local government and the other organisations mentioned in the amendment will almost certainly be less robust than those provided by law enforcement agencies. This raises the possibility that traffic data obtained through the amended RIPA could be accessed by unauthorised users, by exploiting flaws in security mechanisms implemented by organisations not well enough equipped to maintain a high level of security. This situation is plausible and could facilitate crimes such as identity theft, or in extreme (but still plausible) cases result in a threat to national security.

    I would urge you to prevent this order from being passed and further, to encourage a review of the existing RIPA to ensure that the use of the powers it provides is well regulated and monitored. To prevent abuse, the spying on of citizens should be limited to only those organisations who can demonstrate that the information is essential cannot be obtained through other means. Also monitoring of electronic communication, even traffic data, should be subject to same authorising structure as is in place for covert human intelligence such as stakeouts and wiretaps, and hence require judicial approval.

    I would greatly appreciate a reply which addresses my concerns over this urgent matter, and states your opinion on the order currently being proposed.

    Yours sincerely

    Steven Murdoch.

    Additional relevant public authorities for the purposes of section 25(1) of the Regulation of Investigatory Powers Act 2000

    Government departments

    1. The Department for Environment, Food and Rural Affairs.
    2. The Department of Health.
    3. The Home Office.
    4. The Department of Trade and Industry.
    5. The Department for Transport, Local Government and the Regions.
    6. The Department for Work and Pensions.
    7. The Department of Enterprise, Trade and Investment for Northern Ireland.


    Local authorities

    8. Any local authority within the meaning of section 1 of the Local Government Act 1999.
    9. Any fire authority as defined in the Local Government (Best Value) Performance Indicators Order 2000.
    10. A council constituted under section 2 of the Local Government etc. (Scotland) Act 1994.
    11. A district council within the meaning of the Local Government Act (Northern Ireland) 1972.


    NHS bodies in Scotland and Northern Ireland

    12. The Common Services Agency of the Scottish Health Service.
    13. The Northern Ireland Central Services Agency for the Health and Social Services.


    Other bodies

    14. The Environment Agency.
    15. The Financial Services Authority.
    16. The Food Standards Agency.
    17. The Health and Safety Executive.
    18. The Information Commissioner.
    19. The Office of Fair Trading.
    20. The Postal Services Commission.
    21. The Scottish Drug Enforcement Agency.
    22. The Scottish Environment Protection Agency.
    23. The United Kingdom Atomic Energy Authority Constabulary.
    24. A Universal Service Provider within the meaning of the Postal Services Act 2000.

  8. Some suggestions for letters/faxes on Debate Postponed On UK RIP Act Amendment · · Score: 3, Informative
    Unlike the article states, the debate on the RIPA ammendment has been delayed from Tuesday 18th June until Monday 24th June (see Stand.org.uk). This now leaves you time to fax, or better still, write to your MP.

    Here are some ideas and examples of letters that you could use to base the letter/faxes to your MP. However please, please do not just copy and paste significant portions of the letter into your one. This does more harm than good since then the MPs will just ignore both of them and think that you don't care about the issue enought to write your own letter.

  9. Strong password enforcement isn't the way to go on Passwords May Be Weakest Link · · Score: 1
    Everyone knows that strong passwords are mutually exclusive to easy to remeber passwords. You may think that enforcing strong passwords will help, but if you make passwords hard to remember users will simply write them down (a notable security breach of British Telecom was due to a user writing their password on a post-it note stuck to the monitor).

    The solution is a combination of measures. Good security should be a based on something you know, something you have and something you are.

    Something you know is easy, passwords fulfill this purpose but on their own they are not enough. You need to also have something you have, for example a key, or more probably a smart card. This has the advantage that people are generally good at managing the security of physical objects. For example users think nothing of putting their password on their desk, but wouldn't dream of making a copy of their door key and leaving it in the lock.

    Together these options are good, and probably enough for most situations, but if more security is needed then biometrics can be used fulfilling "something you are&quot. As reported, biometrics are not perfect, but in combination with these other methods, biometrics adds significant security to the system. All without reducing the ease of use.

  10. BCS and ACM have one on First, Do No Harm - A Hippocratic Oath for Coders? · · Score: 1
    This has already been attempted by both the BCS (British Computer Society) and the ACM (Association for Computing Machinery)

    Neither cover all important points and both have problems, but they are a good start. In particular neither are very clear when two requirements contradict. For example from the BCS Code of Conduct:
    3. You shall have regard to the legitimate rights of third parties.
    may contradict
    4. You shall ensure that within your professional field/s you have knowledge and understanding of relevant legislation, regulations and standards, and that you comply with such requirements.
    In some cases where DMCA or EUCD apply.

    Despite these problems, the various documents are certainly worth a look:

  11. One network in Glasgow, Scotland on Community Wireless Networks in the UK · · Score: 1
    I'm part of the Glasgow Wireless Network project --- GlasgowNet. We are just starting up but hope to become part of the Consume.net system that was mentioned in the article. GlasgowNet is attempting to provide free public wireless internet access to the Glasgow community. We seek to build on the philosophies of 'open source' and 'free software' and create a philosophy and application of 'open networks'.

    Also you may be interested in the Edinburgh Wireless network --- Backnet which is a little more established than Glasgow. Both projects are generating a lot of interest but we need as many people as possible so if you are interested then check out the Consume.net Node Database to find out who's near you.

    The GlasgowNet page also has some news, reviews and articles that may be of use to people interested in Wireless networks. Both Backnet and GlasgowNet have IRC channels so feel free to come on and have a chat. The Backnet channel is #backnet on irc.backnet.org.uk and GlasgowNet is #glasgownet on the same server. If you don't have an IRC client then GlasgowNet is testing a Java applet IRC interface that you may want to try.

  12. Re:the best combo IMHO on Teaching Linux/Unix Basics to Microsoft Junkies? · · Score: 1

    Does cmd.exe have backquotes? I haven't used the Windows command line since Win95 but I never could find out how to put the results of a program execution into the command line parameter of another program.

  13. Don't get your hopes up on Bertelsman Seeks to Buy Napster · · Score: 0, Redundant
    BMG don't have a history of embracing technology, as shown by the ill-advised deployment of copy protection on their CDs.


    Unfortunately they didn't learn their lesson and are still producing more broken CDs that don't play on normal equipment and have been rumoured to damage CD players.

  14. Another article and discussion on Distributed Translation Project · · Score: 1
    There's another article and discussion on Advogato


    Of particular interest is that it discusses using trust-metrics, in a similar way to Advogato itself, so as to differentiate between good and not so good translators.

  15. Re:Hitting the wall with syntax. on Interview with the Creator of Ruby · · Score: 1

    Your complaint about Ruby seem to apply to many other languages. I am curious to know what languages, in your opinion, do not have the weaknesses you describe. I would also be very interested to know why you believe these lanuages to be better.

    I'm not trying to belittle your complaint, I'm genuinly interested in having a look at better programming languages.

  16. Good news, but more work still needs to be done. on BMG Backs Down Over Copy-Protected CD · · Score: 3, Insightful
    I'm glad to see BMG have been forced into seeing sense. Hopefully BMG will have lost enough money in this pointless exercise so that they won't try this sort of trick again. I also hope they realise that to customer loyalty is easily lost, but hard to gain so they need to treat the public with more respect. Virgin Megastores, in contrast, have the right idea, they seem to actually care about their customers. Top marks for them!

    Also I wholeheartedly agree with Virgin's statement: "As retailers we do support the fight against copyright theft, however this should never be at the expense of the customer."

    I have no objection to meaures that prevent only illegal or immoral behaviour, but by preventing digital copying the record companies are preventing the public from making legitimate, legal and moral uses of their CD, such as making a backup copy for safety reasons or transferring to a MP3/Minidisc player. I am also unconvinced that such draconian measures need to be put in place since the availibility of MP3s has not been shown to decrease CD sales, in fact the contrary seems to be the case, as shown in the paper "The Use of Conventional and New Music Media: Implications for Future Technologies" by Brown, Geelhoed and Sellen (2001).

    This paper argues that intangible files, such as MP3s will never replace the role of physical objects such as LPs, CDs and casettes since music enthusiasts are collectors, and just the ability to listen to music is not enough, rather a tangible object is desired. Instead of trying to eliminate duplication of Music (which, both historically and technically, can be seen to be impossible), they would be better to use it to their own advantage, which would help them, the artists and the public.

  17. Midbars patent application for Cactus Data Shield on BMG Backs Down Over Copy-Protected CD · · Score: 5, Informative
    Even though Midbar deny there is any chance of Cactus Data Shield damageing equipment, you may be interested to see an extract from Midbars patent application for the technology.

    Of particular interest is the section:
    During duplication the CD encoding circuitry merely sets the P-channel=0 while recording to the data are, and therefore the P-channel setting of portion 60 is ignored. Thus, during playback, the substituted audio data portion 58 is provided to the digital-to-analog converter as normal data, resulting in audio distortion and potentially damaging the output circuitry. (emphasis mine).

    They also don't seem to be as confident about audio quality as I would have hoped:
    Thus, the substitute audio data portion 58 of FIG. 4B is ignored, and instead an interpolation, substantially equivalent to the original portion 50 of FIG. 4A, is output, thus resulting in little or no net difference in audio quality between the corresponding track port 44 and 52 of FIGS. 4A and 4B (again empahasis mine).

    If I buy music, I want the CD to be as close as possible to the real thing, not with any noise added.

  18. Finding out the history of webpages on Fink Maintainer Steps Down Due To GPL Infringment · · Score: 1, Informative
    In his webpage, Christoph mentions: "I guess I should have made daily backup copies of their front page. It will be interesting to see how long it lasts this time..."

    The website Wayback Machine allows you to see the way website looked in the past. For example:
    macosx.forked.net in September or
    slashdot.org from 1998.

  19. Useful resource on how to migrate software on Migrating Large Scale Applications from ASCII to Unicode? · · Score: 5, Informative

    A very useful resource on Unicode is this page, written by Markus Kuhn. In particular you may be interested in How do I have to modify my software?; while it does concentrate on Unix, the general principles should be the same on any OS.

  20. Re:Sorry on News.com: Crypto Doesn't Kill - People Do · · Score: 3, Informative
    It is true that any mathematical expression can be modified to find lost values, but there is nothing to stop one way from being much harder from the reverse. For example it is easy to smash a plate, but while it is possible to reassemble the pieces into the original form, it is much harder.


    Problems like this exist in maths as well as the physical world. One such problem is used in RSA encryption, which can be used in PGP. This problem centers around the belief that it is easy to multiply two very large prime numbers, but given the product it is very difficult to go back to the original primes. I say belief deliberatly since it is possible (albeit extremely unlikely) that there is an easy way to factor large numbers. Most PGP implementations actually use Elgamal rather than RSA, but the principle is similar.


    If you are interested in this subject I would strongly recommend you buy/borrow a copy of Applied Cryptography by Bruce Schneier (amazon link). This is the best crypto book available (IMHO) and explains the fundementals of the suject, including the maths behind RSA and ElGamal without requiring any previous knowledge.


    Hope this helps.

  21. Re:You can't have it both ways. on Legislating Insecure Encryption · · Score: 1
    So you don't use encryption and you don't know anyone else who uses encryption.

    I assume you don't use mobile phones (the GSM standard uses the A5 encryption algorithm to send data between the phone and base station).
    I also assume you never have heard of someone buying stuff online; HTTPS/SSL is encryption too.
    To avoid encryption you would also have to avoid all banks, since I doubt their transactions are carried out in plaintext.

    Encryption is used in many situations, it's just that it is often not apparent. The majority of bank customers, mobile phone users and ecommerce clients are just norma people, so I would suggest that you learn more about the issues involved before you categorise the majority of the Western world's population as paranoids and criminals.

  22. Re: My view: against encryption, for saving lives on Blaming Encryption · · Score: 1
    That is a fair point, but as you say it is only valid IF it would help save any lives. However it is obvious that it will not, firstly strong encryption software is publicly available, anyone who may want it can get it with little difficultly. Should any ban be put in place it will only apply to the US so criminals will either stick with their current encryption software or obtain it from another country. Secondly even if the software can be restricted there are plenty of copies of books that would allow a competent programmer to write a simple but strong encryption program in less than a week. Unless the US Government is advocating book-burnings they cannot restrict this knowledge.

    The only other statement I have heard is that if strong encryption is illegal then it will stand out from unencrypted and weakly encrypted communications, but this is clearly not true for any software designed to hide the fact that it contains strongly encrypted data. Firstly all encrypted data resembles random noise, in order to check whether it contains strongly encrypted data it would attempt decryption of every passing message, whether a court order was present or not, which would be a massive invasion of privacy, but technically feasible. The main problem is of that stegnography; software and books about this subject are widely available so as I have mentioned it is impossible to restrict the availability to criminals. Using a stegnography program it is possible to add data to an image or audio file, and since strongly encrypted data is indistinguishable from random noise it is impossible to show that a data file contains hidden data without breaking the encryption itself.

    In summary, restricting the availability of encryption software will not help in any way to catch criminals or prevent crimes. It will only succeed in giving people in government organisations more power over law abiding citizens than the have at the moment, which given the history of governments in general and the US Government in particular, would not be a good idea.

    In my opinion these laws are being proposed as a knee-jerk reaction to the tragic events of September 11th. They will appease the majority by persuading them that helpful action if being taken, since many people do not understand the issues involved, but only succeed in hiding the true problems. In order to prevent events like this in the future, effective action could be taken, but all the options are very expensive. Banning strong encryption is cheap but gives the public nothing more than an illusion of safety.

  23. Re:DNUK Sell Laptops with Linux preinstalled on Which Laptop To Buy? · · Score: 1
    Whether weight is a big disadvantage depends very much on your usage. The reason I bought it was not so much as a laptop, but more as a semi-portable desktop. For portable computing I have a Handspring Visor, the laptop is for when I have a base to work from, but I'm not at home. For example I'm currently working in London and my desktop is around 800 miles away. Bringing down 4.2Kg weight on the plane is not comfortable but perfectly acceptable, thereafter it lives in my hotel room for a few months. I would have to send my desktop down separately which with a 17" monitor would be very heavy.

    If you want a laptop to bring into work every day then the Quadra-150 is definately not for you. But in my case the 150 is many times lighter than a desktop, and possibly similar to a lighter notebook when you add thinks like CD, floppy, network card which are often external on the lighter notebooks.

    I do need all these things along with a 15" screen since I do do quite a lot of graphics work (mainly 2d). I also need as much CPU power as I can get since the coding project (also involving 2d graphics) I'm working on currently uses 100% CPU for about 3 hours so a Celeron will just not handle it in a reasonable time. Since I work from a hotel room battery life is not much of an issue. I'm not sure whether the problem that you are having is the same as mine. I can shutdown fine, "shutdown -h" closes all the services cleanly and then powers down the computer. It is only "shutdown -r" that closes all the services but doesn't reboot the system so I have to use the power key to turn it off and on again. The DNUK tech support people have been trying to fix this problem so I would recommend asking them about it.

  24. TRS-100 on Which Laptop To Buy? · · Score: 1

    How about a TRS-100. Costs only $250, it's robust and will last 16 hours on 4 AA batteries, what more could you ask for :-)

  25. DNUK Sell Laptops with Linux preinstalled on Which Laptop To Buy? · · Score: 1

    One company that might be worth a look is DNUK. They sell laptops with Linux preinstalled. I bought one a week ago and so far I'm impressed. All the hardware works with Linux (apart from the TV-Out and the Winmodem, but there is a PCMCIA modem available) and it all works out the box, except it hangs on reboot, but halt works fine. So far the support staff have been very helpful. The only disadvantage is that my one is quite heavy (being 15" screen and inbuilt everything) but the 14" models are significantly lighter. Have a look at DNUK Laptops for more information.