Slashdot Mirror


User: holophrastic

holophrastic's activity in the archive.

Stories
0
Comments
2,817
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 2,817

  1. So we're all in agreement? on Sexism In Science · · Score: 1

    I'm confused. If men think women deserve less, and women think women deserve less, then who's arguing? Maybe, just maybe, oh, I don't know, women deserve less?

    You know, I called eight painters this week to get quotes for painting my house. Not a single independent painter of the eight was female. Since there's absolutely nothing making women worse painters than men, I can only guess that women choose to not start painting businesses. Maybe it's a "man's world" because women choose to avoid perfectly fine industries. I can't say why.

    So perhaps, instead of focussing on why men don't allow women into the clubhouse, perhaps women should take it upon themselves to teach women to accept women. Perhaps then men will respect women enough to allow them into the clubhouse.

    But until then -- until women help women -- they'll always be treated as lesser by men. And rightfully so. If women always need help from men -- in this case because they don't help eachother -- then they can't possibly expect respect from men.

    Maybe the gardeners that I call next week will be female -- not that I've ever seen a female gardener in the neighbourhood. Come to think of it, I've never seen a female valet parking cars either. Of course I've never seen a female papergirl either. And female pizza delivery, only in movies. Haven't seen a female taxi driver either.

    I live in a growing neighbourhood with dozens of houses being built every month. I haven't seen a female builder either. Not a female handychick. Not a female duct cleaner.

    So how can I possibly have equal respect for a female worker when I typically don't see them running their own businesses in the community? I started my own business. Why don't they?

  2. anyone can use on their site... on Google Gets Into Politics With Civic Info API · · Score: -1, Troll

    so google's looking to capture people's voting choices in advance of any election anywhere. Yeah, that's what we want. A system that prides itself on privacy and anonymity having all of its information duplicated to a commercial party. great idea.

    please don't use this.

  3. Re:Seriously? on Hotmail No Longer Accepts Long Passwords, Shortens Them For You · · Score: 1

    It makes no difference how. none at all. name a security algorithm that's remained secure for ten years. I'll point you to the numeral in sha2,

    And "resistant" is different than "proof" for a reason.

    And I never said that you can find two strings that hash to the same value. I said that two exist, and hence there is no additional hash space created by a longer input string -- because the output is still the same 16 bytes.

    Read harder.

  4. Wow on Ubuntu Will Now Have Amazon Ads Pre-Installed · · Score: 1

    Windows has been sold with literal pounds of adware installed by OEMs, but at least the OS itself has always been clean. This story honestly stuns me. I've never heard of an operating system advertizing to the user directly. That's like my car reading me an ad every time I pull into my driveway.

  5. Re:Seriously? on Hotmail No Longer Accepts Long Passwords, Shortens Them For You · · Score: 1

    You might want to learn the definition of "resistant". Try it first with your wristwatch. Don't use mine.

  6. Re:Seriously? on Hotmail No Longer Accepts Long Passwords, Shortens Them For You · · Score: 1

    The fact that you wouldn't succeed in *intentionally* producing two inputs with identical outputs changes nothing. Your big input is reduced to a smaller output. It doesn't matter why, and it doesn't matter how. Your input has been reduced. Information has been discarded.

    That's why you can't use the 256-bit hash to install ubuntu. It's missing nearly 4GB of data. That hash isn't a security measure. It's a transmission check. It checks to ensure that transmission hasn't dropped packets. It's alslo used as security today, purely because it's tough to succeed in making something different hash the same. But a) that need not always be so; and b) the entire point of your perspective is that for "small" hash lengths it's very easy (consider a 1-byte hash output today); c) much like with every security measure, it'll be broken by someone eventually anyway. So your point is moot.

    More importantly, welcome to security theatre. No I can't guess your 100-byte password. Excellent. I can still ssh into the server and gues it's 10-byte password. Congrats on barring the door, and not the window.

  7. Re:Seriously? on Hotmail No Longer Accepts Long Passwords, Shortens Them For You · · Score: 1

    yeah, and you get 16 bytes. that's what they do. and as a result, there's no reason to ever give it any more than the 16 bytes of input. since "tnloehurlildoeucidtnoehudibwhmoeudbitnh" hashed produces "tughetucnoturecn" and "ilcroeuoeuitnsh" produces the exact same hash. so what benefit is there to having the longer input? It doesn't increase security at all. you're just picking a longer equivalent string. Because the hashing LOSES information.

  8. Re:Seriously? on Hotmail No Longer Accepts Long Passwords, Shortens Them For You · · Score: 1

    But I don't think it is moving backwords. You're talking about improving the part of the system that is not the bottle-neck. Who cares? That's always a waste of time. It's like making one link in the chain way stronger than the others. It doesn't help the chain at all -- not one bit. (ha ha, bit)

    The goal, in security, is to figure out where the effort is best spent. And in this case, I don't think it's in password length. So then making it even 17 characters is a total waste of everything. Like getting a thicker steel door, when the windows are still glass. Or better yet, like strengthening your door, but not the hinges. Or strengthening your dead-bolt but not the door frame into which the bolt locks. You can have the strongest titanium dead-bolt in the world. I can still kick your door in if it's in a wall of straw.

    Password length is only one link in the chain. and I'm saying that 16 characters is already way past the strength of the other links of that same chain.

  9. Re:Seriously? on Hotmail No Longer Accepts Long Passwords, Shortens Them For You · · Score: 1

    There's just no point in your input being any bigger, since the hash output never will be. welcome to hashes. you seem to be saying that you'd prefer they not tell you.

  10. Re:Seriously? on Hotmail No Longer Accepts Long Passwords, Shortens Them For You · · Score: 1

    Oh, and hotel doors too.

  11. Re:Seriously? on Hotmail No Longer Accepts Long Passwords, Shortens Them For You · · Score: 1

    First, you don't know how much google's passwords accept. You know that they don't tell you it's only 16, and it may be 17, but it probably isn't 10'000. So where's your line? Is 17 enough? What about 32? How about six megs?

    Second, I think that if you look into it, you'll find that biometric locks are actually inferior to good mechanic locks. Generally, no matter how much digital interface you put onto a door, the lock itself is still mechanical -- something physically stops the door from opening.

    So given that the lock itself is really good, what's more difficult to defraud: a) a piece of metal carved specifically for the lock; or b) an electrical voltage from a near-by circuit?

    Your fingerprint doesn't actually open the latch. It runs in a computer, which then has a simple circuit that triggers the latch. Hardware hacking is often VERY easy purely because biometric locks actually ADD a new way to open the latch -- with an electrical signal. Mechanical locks don't have any such entry path. The key actually does physically unlatch the door -- assuming it's a deadbolt.

    What you call "progress" is what I'm calling "paper progress". Why would anyone pay ten times the price for a mechanical lock that looks the same as every other mechanical lock? But wait, this new high tech lock has computers inside, and reads your fingerprint, that's why it's worth ten times the price. Yeah, in raw materials certainly. But not in actual safety.

    Not to mention, again, fingerprints are the all time dumbest way to lock anything. The reason fingerprints exist in technology is for forensics. And the reason forensics like fingerprints is because humans tend to leave them everywhere accidentally. Why oh why would you want to lock your home with a key that you leave copies of everywhere you go?

    Sounds incredibly retarted to me. And I hope it does to you too. It's like every time I touch anything, I leave a very delicate version of my house key -- instead of brass it's, I don't know, jello. It's something that everybody can see, and with basic equipment can copy and reproduce in brass all by themselves.

    But they don't need to because hardware hacking is cool. A pin inserted in the right place can open that biometric lock. How many slashdot stories have featured such things in the last month alone? I recall gun safes, and airport office doors off teh top of my head.

  12. Re:Seriously? on Hotmail No Longer Accepts Long Passwords, Shortens Them For You · · Score: 1

    Wow, ok, now it's you who doesn't understand hashing algorithms. sure the first 16 of my 100 will produce a different hash than the 100. But some other 100 will produce the same hash as my 100. in the end, there are only 16 bytes worth of hash. more of your parameter fed into the hash doesn't change that. I thought I gave a pretty good example with the door lock, which effectively hashes 10 digits into 5 digits -- albeit by position which is quite apparent to the observer.

    And yes, as a free service, you get no *right* to anything. the advertizers are the client, not you. you get nothing more than what you're given.

    And no, 16 characters isn't insufficient. Again, these aren't your most prize possessions, these are shitty e-mails that you aren't even willing to pay for -- and it doesn't cost much to run your own e-mail server. Roughly $100 annually can cover you. $500 annually will cover you and half of your neighbourhood. So if you're willing to pay absolutely nothing, you don't get to complain about it. Do it yourself, it was never difficult.

    And once again, 16 characters is sufficient. There's no end to the amount of security that's possible, and you'll never stop Ethan Hunt. So once you stop 99% of the attackers, you're done -- physical safety and actual dollars aside.

  13. Seriously? on Hotmail No Longer Accepts Long Passwords, Shortens Them For You · · Score: 0

    A website chooses not to store an infinite length password of yours, and that makes headline news on slashdot? seriously, that's a problem? Guys, it's free third-party e-mail. It's not your safe-deposit box.

    Oh, and by the way, you can make the key to your safe-deposit box as long as you want, the lock will still only accept the first inch of it. Your girlfriend also won't accept more than 16 inches, by the way. Sometimes things are larger than capacity will allow.

    Not to mention, we all know exactly why they won't take more than 16 characters. Any bets your password's simply hashed into a 16 byte string anyway? Congrats, on your 17 character password being converted into 16 anyway.

    But hey, car doors and house doors with entry codes have 5 buttons each doubly-labelled. So 1 & 2 are on the same button. Making 11, 12, 21, and 22 the same double-press of the same button.

    Complain harder. Maybe then things like this might matter. Right now they make absolutely no difference whatsoever.

  14. Re:what "take advantage"? on Another EUSecWest NFC Trick: Ride the Subway For Free · · Score: 4, Insightful

    No, we shouldn't. There likely isn't enough fraud to warrant such measures. Besides, the system that you describe has huge maintenance costs. You can't have these things stop working during rush hour. And between the central server itself, network nodes everywhere, and wireless lag, there's expense, personnel, and it'll slow things down too. And in the end, you'll have a huge network, with so many nodes that it can be hacked directly anyway. Then you'll want to secure that.

    On top of everything though, crime isn't the responsibility of the transportation department. If people are commiting fraud, that's what police are for. Transportation doesn't want to pay for it, and I don't blame them. I wouldn't pay for it either.

  15. what "take advantage"? on Another EUSecWest NFC Trick: Ride the Subway For Free · · Score: 5, Insightful

    That's not taking advantage of anything. The card's programmable, you programmed it. Congrats. That's like printing a transfer on your home printer. Same illegal it's always been.

    So tell me again why these cards don't authenticate against a central reliable source? Oh yeah, we're replacing slips of paper, not brinks trucks with armed guards.

    Right.

    High-speed traffic is still controlled with painted lines, not concrete walls. Not everything is security-related.

  16. chicken and egg on Apple's Secret Plan To Join iPhones With Airport Security · · Score: 1

    I think people are idiots. The chicken and egg problem isn't a cause and effect problem. It's a language definition problem. The question's the only issue.

    1. eggs came first because lizards laid eggs long before chickens evolved. so we're talking about "chicken eggs" not "eggs". So we rephrase: "what came first, the chicken or the chicken egg"

    2. at some point, something that wasn't a chicken laid an egg from which a chicken hatched

    3. if your definition of a "chicken egg" is "laid by a chicken", then the chicken came first, necessarily by your definition. on the other hand, if your definition of a "chicken egg" is an egg that hatched into a chicken, then the chicken egg came first, necessarily, by your definition.

    4. if you don't believe in evolution, then the whole question is meaningly, since your god probably made them both together about ten years ago, when he created you as a full-grown adult.

    So it's a stupid question because all it actually asks is for your definition of a chicken egg. And that's really of no interest most of the time. Most scientists define evolution as happening within the egg, so the egg would be a chicken egg after it was laid and before it hatches. So the egg comes first.

  17. I can't teach, I program for a living. on Can Anyone Become a Programmer? · · Score: 2

    Of course it takes a certain kind of person. Doesn't evening?

    For example, I can't teach anything to anyone. I can't even teach my cousin to use my alarm system, so it's just easier to not arm the system when he's around. The skill that I lack is to serialize information in a manner able to be conveyed to another human being.

    The reason I lack that particular skill is because I'm always in programming mode. And in my programming, it's about "layered truth statements". It turns out that layered truth statements aren't easy to communicate in english -- in part because english announces such ambiguity in any given sentence that truth statements often fail outright.

    Since most programming is done in with positive truths, (SQL especially comes to mind), to be a programmer one must fluidly drop english from their mind. Anyone who can't do so (the way I can't teach) will forever struggle.

  18. They don't care on Ask Slashdot: How To Prove IT Knowledge Without Expensive Certificates? · · Score: 1

    I've been working in the industry for over 20 years, 18 years with my own business. No one asks me about my skills, about my credentials, or if I even went to high school, let alone graduated from it. All of my clients come from the word of mouth of other clients. Correctly, no one could care less.

  19. Re: d on The Futility of the Ongoing Piracy War · · Score: 1

    Actually, the fact that I disagree with them is the very definition of my saying that they are wrong. That's what opinion is all about. You have no reason to be here stating your opinions if you don't think that opinions have any meaning.

    More importantly, the shades of grey don't mean anything to the people who are complaining -- in this case the ip owners. So the fact that the illegitimate downloaders create shades of grey means even less.

  20. That's just stupid on Astronomers Fix the Astronomical Unit · · Score: 1

    There's no point in a unit (AU) being a large multiplier of another unit. We have an entire metric system for that (well, some of us do). The nice part about AU was precisely that it represented something dynamic. I don't always care how far away some asteroid is to the metre. I want to know how far it is relative to the sun.

  21. d on The Futility of the Ongoing Piracy War · · Score: 1

    I've got no problem with the concept of people doing bad things -- illegal or otherwise. Whether you steal a candy bar, graffiti a mailbox, or get a game without paying for it, these are all minor things that don't kill anyone. But whether or not the law as written or the law as enforced can or do count your actions as illegal, they most definitely aren't ethical by any consideration.

    You're fabricating shades of grey just for fun. Still, throughout every shade, I don't want to be the guy who worked hard to create the content that you didn't pay for. It doesn't matter why. You weren't forced to play my game, child or not, affordable or not.

    Case in point. If I make a game, choose to price it at six million dollars per copy, and choose to make it available only from one radioshack in the park, that's my right to do with my own creation. If you want to steal it, that's one thing. But you don't get to use my distribution and pricing as an excuse for your actions.

    Man up. You stole it. It's not the worst thing that anyone has ever done. You did it intentionally. It wasn't a political protest. You wanted something and you didn't want to get it legitimately. Man up.

    Here's another shade of grey. Commercial advertisements and news coverage and reviews make Game of Thrones sound like the greatest show ever. Professional marketing makes me want it like crack. So I'm addicted to it before I've ever seen it. And hence, I steal to support my addiction because it's not available through my cable provider.

    Oh yeah, and I never learned to just say no to yet another derivative tv show.

    Or, perhaps, I did; I've never seen the show, and really, I've survived just fine.

    By the way, as a child, I stole a $0.05 candy coke bottle, in university I stole three bottles of five alive -- but only because I'd forgotten to pay for them, and didn't go back when I discovered so -- last year the wind took my car door into another car door and I didn't leave a note or anything -- I don't feel bad because the other car was more or less rusted through, not that my paint transfer improved it at all -- and while Game of Thrones easily passes me by, some shows don't.

    Man up. It's not a good thing. And though I haven't killed anyone, I'm not proud of everything I've done, do, and plan to do. But hey I also plan to take advantage of a few social encounters this weekend. I don't always plan on being nice. Sometimes I plan to be selfish to.

    And I definitely, frequently, and recreationally, drive well above the speed limit -- but not around schools.

  22. Re:It costs $2'000 per year on Ask Slashdot: When Is It a Good Idea To Incorporate? · · Score: 1

    certainly $2K is high. but between the accountant, and the corporate lawyer (to cover the meeting books, the shares, the partnership docs, various NDAs, and the occasional contract), and being in a big city, even my tiny $200'000 service-based single-man company winds up spending $2K quite easily. It's not 3, but it's definitely more than 1.

  23. It costs $2'000 per year on Ask Slashdot: When Is It a Good Idea To Incorporate? · · Score: 1

    up to $2K to incorporate, and up to $2K in accountants fees annually. But that's about it (in Canada). It's a bit of a nuisance in that you've got to spend about 5 hours annually with simple paperwork and phone calls and keeping government records up to date when you move.

    So the answer is simple. When you can write-off $10K annually, you'll save yourself the $2K in taxes alone. Between home offices, client meals, car allowances and more, it's all very quickly worthwhile.

  24. Doors vs Vault Doors on Should Developers Be Sued For Security Holes? · · Score: 4, Interesting

    Just like anything else, pay for whatever guarantee you desire. If you want your software created in record time, for a low cost, then the bugs are a part of the equasion. If you want secure coding, then you'll get to pay for it in time and money. It's always been that simple. You don't sue the manufacturer of your house door, but you do sue the manufacturer of your bank vault door. The difference in cost is tremendous.

    It's rare that my clients ask for proper security. But for the elements that they do indeed want to protect, they pay for me to do my very best work. And you'd better believe that they hold me responsible and often accountable for significant problems should they result.

    But in the end, it's all just insurance anyway. If a client of mine wants a particular e-commerce feature to be super-secure, then they'll ask me to pay for any dollars lost due to bugs. I know that I'm not perfect, and of the thirty possible bugs, there's a small chance that I'll fall into one or two of them, and a partial chance that I won't catch it before it's exploited. So while much of the added price is for me to sit there and check things closely, the rest of the added price is for me to accumulate in the event that I need to pay it back. Over multiple clients and multiple exploits, that's the only way to do it.

    The obvious alternative of checking things even closer winds up being far more money, and is only really relevant when physical safety is an issue.

  25. Interesting on Genetically Engineering Babies a Moral Obligation, Says Ethicist · · Score: 1

    But there's a nice difference between serious flaws like major diseases and personality flaws like alcoholism. There's virtually zero chance of overcoming a major disease, but there's a huge chance of overcoming a personality flaw. While the former creates a never-ending drain on others, the latter typically does not. What's more, the latter results in quite a significant perspective shift, which we often call inspiration.

    I'm also intrigued by something more. The "best-suited" person in this day and age would never volunteer for military service, not be likely to protest anything, never understand the plight of those suffering with personality flaws, not waste their life to create amazing art. . .

    Ok, so I've just described myself. I look forward to more of me!