Slashdot Mirror


User: An+Onerous+Coward

An+Onerous+Coward's activity in the archive.

Stories
0
Comments
3,919
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 3,919

  1. Re:And yet- on What's Wrong With the American University System · · Score: 1

    Interesting prescription. Just how many kids in a given class can "gain self esteem" by "being one of the best in their class?" You know what's really great for a kid's self-esteem? Being valedictorian. So let's just tell the rugrats that their self worth is dependent on being valedictorian of their graduating class.

    What could possibly go wrong?

    When you make education a hypercompetitive endeavor, you turn self-esteem into a zero sum game, where you can only gain it by taking it from somebody else.

    You need some numbers to back up this intuition of yours. Demonstrate that kids learn more effectively in more competitive, less self-esteem focused environments. Cite the studies, show the numbers. The evidence I've run across suggests that kids learn more when competition is less intense. Mind you, the intensity of competition is measured in terms of overall societal income inequality, with "less competitive" schools being the ones in countries where income inequality is small (implying that the rewards for success and punishments for failure in school are comparably small).

    Now, this says little about what it actually feels like inside the classroom. Perhaps the modern Finnish classroom is actually a hotbed of Machiavellian intrigue, where students who perform poorly are brought to the front of the classroom for a few minutes of shaming every day. Nor is it easy to compare across societies. But the statistical correlation is that, societies which have little to threaten their kids with (where doing well doesn't bring obscene wealth and doing poorly doesn't bring a life of grinding poverty) seem to outeducate America and other highly unequal societies (where the income disparity between the top and bottom earners is high).

    Your insistence that we just need to push kids harder (presumably by hounding them with the threat of losing their position in society to better-performing competitors) seems misguided in light of that correlation.

  2. Re:Or do not have variable delays at all on OAuth, OpenID Password Crack Could Affect Millions · · Score: 1

    I'd never heard of anyone hashing a password on the client side, but I don't see how doing so would provide any security. If an attacker is listening in, he might not be able to recover the original password, but at that point, he doesn't really need to. All he needs to do is send an http request with hashed_password=a40387b0f3aa... as a parameter. And I'm not clear on how you would do the salting on the client side. If it comes from the server, then the attacker can capture the salt with all the other traffic. If it's stored in a cookie client-side, then I'd suppose that clearing cookies from the browser would lock you out of the site.

    I'm not saying you're wrong. I've just never heard of it. Typing "client-side password hashing" into Google brought up a few results, but the first hit seems to agree with me.

    But I think you're right. If you're doing client-side hashing, then you're effectively doing the described attack, but on the (probably longer) hash string rather than the original password. No need to find strings that hash correctly.

  3. Re:Time for a secure strcmp()? on OAuth, OpenID Password Crack Could Affect Millions · · Score: 1

    >> As noted above also, sleeping is a more efficient use of processor resources than performing non-important calculations.

    Only if you're doing a large amount of non-important computation, or ignoring the cost of the context switch. Neither is the case here.

  4. Re:Or... on OAuth, OpenID Password Crack Could Affect Millions · · Score: 1

    It is more secure. These attacks wouldn't work over a network at all, except they found a way to subtract network latency. You might have to put back in a large amount of random delay, but eventually the noise should swamp the signal and make the attack infeasible.

    It's not the best approach, I know.

  5. Re:Who doesn't hash/encrypt passwords? on OAuth, OpenID Password Crack Could Affect Millions · · Score: 1

    No, but you could send passwords whose hashes match the first n bits of the hash. Use this knowledge to decide which passwords you're going to try. It should reduce the search space tremendously.

    Now, if the passwords are being salted, you can't use this technique either, since the hash it's matching isn't the hash you think it's matching.

    I guess another approach might be to check the bytes in some random order.

  6. Re:Who doesn't hash/encrypt passwords? on OAuth, OpenID Password Crack Could Affect Millions · · Score: 1

    It looks like you're not salting your passwords. Each user should have a unique salt, which means you'd have to pull them up by username, add the salt to the password, then do the hash.

    At that point, you *could* do a second SQL query to check the password. But you already have the user's entry.

  7. Re:Add a random delay on OAuth, OpenID Password Crack Could Affect Millions · · Score: 1

    You're making it a lot harder, true. But you seem to be claiming that it makes it mathematically impossible. Which it doesn't, but it's probably close enough.

    According to the article, the attack uses algorithms to weed out network latency. So if you add much of that randomness back in, in a way that they can't factor out, you're probably good.

    Still, it seems to make more sense to just require the comparison to always make exactly 64 comparisons. That's faster and more certainly invulnerable than adding between 0 and 100000 comparisons.

  8. Re:Or do not have variable delays at all on OAuth, OpenID Password Crack Could Affect Millions · · Score: 2, Informative

    Hashing should make a huge difference, though. If you're comparing the passwords themselves, it's pretty straightforward. To crack the hash, you have to find an acceptable-length string that hashes to each subset of the target hash (a..., a0..., a0f..., a0f4..., a0f49..., etc.) I don't know if there is a way to do that other than brute force, and toward the end the search space is prohibitive.

    I think the best you could to would be to get the first several digits of the hash, then use it to prefilter the guesses you're sending to the service.

  9. Re:Yeah, but what about the other 95% on The Creativity Crisis · · Score: 1

    In order to notice a drop, you have to have at least two data points. If you run the test every single year, then we're talking thirty or forty data points. That's enough to get a sense of how much noise there is in the data, and see evolving trends.

    Nor do we really need to know what's happening to the rest of the world. That's like seeing a spike in the murder rates in Sacramento, but saying that we can't draw any conclusions at all without comparing it to the murder rates in Charleston and Duluth. Comparative data might give you some insight into the cause of the spike. But you don't need it to know that the spike occurred, and of course it's foolish to say, "Well, if the spike is also happening in Las Vegas, then we should start to worry."

    Comparative data inevitably introduces confounding factors. Even if we discovered that we are alone in the decline, it would still be worrying.

    Now, all of this is assuming that the test is measuring something specific and important, in an accurate way. I still question those assumptions.

  10. Re:The misdirection is serious. on The Creativity Crisis · · Score: 1

    Per "The Spirit Level," there is a strong correlation between a country's academic achievement and its income equality. As I once blogged:

    Imagine two relatively wealthy, industrialized societies. In society A, the price for not getting a good education is a life of poverty and shame. In society B, there is little market incentive not to squander your education, because the government provides generous welfare and unemployment benefits.

    In Society A, the wealthiest people (those in the top 20%) make about ten times as much as the poorest people (those in the bottom 20%) do, so the rewards for being ambitious and doing well in school are huge. In Society B, the same comparison shows the wealthiest members of society only make about four times what the poorest do, so there is markedly less financial incentive to do well in school.

    In Society A, polls of high school students show that almost all of them want to attend college. In Society B, a large fraction of the students say that they'd be happy with trade school. Thus, you would expect students in Society A to be more motivated to excel in their college preparatory work.

    No surprise, Society A is the U.S., Society B is Finland, and despite what a social darwinist right winger would say are strong disincentives against performing well in school -- no chance at great wealth if you succeed, no risk of poverty if you fail -- Finnish kids outperform American kids by a wide margin. An interesting feature of this gap is that it is narrower when comparing the children of our wealthiest to the children of their wealthiest, and widens steadily as we go down the socioeconomic ladders.

    It's almost as though giving kids security about their future and their place in society leads to a more conducive learning environment. But no, that's crazy.

    Context: It's not just U.S. v. Finland in a Mathlete smackdown. The correlation is statistically significant across the industrialized world.

    I have other reasons for thinking that decreasing income inequality will improve our education system, partly because of the issue you pointed out: parental involvement. But the point is, there are things that could be done at the federal level to improve educational outcomes. They're just not the ones you'd think of first.

  11. Re:Expected on The Creativity Crisis · · Score: 1

    >> I frankly do not care how things work in other places - I am concerned with how they can be made to work here, especially for my children.

    Let me guess... American?

  12. Re:How secure on Bitcoin Releases Version 0.3 · · Score: 1

    Ladies and gentlemen, the fallacy of "there-is-but-one-factor history" in a nutshell. Well done!

    Yes, the U.S. went off the gold standard in the early '70s, and yes, the decades after showed slower economic growth than the first post-war decades. But that wasn't the only thing that changed. We also had energy shocks, the rise of Asian/decline of American manufacturing, the rightwingification of public policy*, ever more free trade, Internet-enabled offshoring, the first warning signs that exponential growth might not be the ideal recipe for a finite planet... You really want to crown your single pet factor as the cause of all our woes?

    Need I remind you, the reason we left the gold standard in the first place was because we were already in financial trouble. You can argue that we would have been better off sticking to it, tightening our belts and paying our debts then. But clearly the gold standard didn't inoculate us from financial mismanagement.

    Lastly, the pre-Federal Reserve history of U.S. banking doesn't give us much confidence in the gold standard. I don't think a decade went by without some major financial catastrophe.

    * Between 1968 and 2008, Republicans were in office for 28 years, Democrats for 12.

  13. Re:uhm, missing the point on Has Any Creative Work Failed Because of Piracy? · · Score: 1

    Psssh. If you're going to bootleg Twilight, show a bit of self respect and bootleg the Rifftrax commentary too.

  14. Re:uhm, missing the point on Has Any Creative Work Failed Because of Piracy? · · Score: 1

    Even the most idealistic, passionate artist needs to eat. Yes, there are intangible joys to being a creative person. But the artist needs to get those tangibles in her belly before she can really enjoy them.

    There are artists who are only in it for the paycheck. There are artists who are so passionate about their craft that they'll do it with no expectation of any remuneration, much less obscene profits. But first there must be food.

    I'm in the middle of the second draft of my first (crosses fingers) novel. It's slow going, precisely because the work is something I have to make room for in my life outside of my occupation, rather than my occupation itself. Even knowing that there was a 50% chance of it selling would be a huge motivation to finish.

    I think artists are -- and should be -- concerned about making a livelihood. The idea that making a living off your creative work* is somehow crass or demeaning to true art needs to die a quick death.

    * as contrasted with Rowling-esque megaprofits.

  15. Re:Let the rationalizations begin on Has Any Creative Work Failed Because of Piracy? · · Score: 1

    If an author can't make a living from your writing under a 7-year copyright (I think 20 would be a better number), how is an additional hundred years going to help matters?

    Personally, I'd prefer a staggered system, where a work enters the public domain either ten years after the publisher stops printing new copies, or twenty years after first publication. Noncommercial copying might get a free pass after fifteen years, and non-commercial derivative works (read: fanfic) would be legitimate from day one.

    That's plenty of time to recoup the author's and publisher's investment, while letting work into the public domain while it still has intellectual and cultural relevance (which, I guarantee, 99.44% of everything published before 1920 no longer does).

    Your Randite screed (in defense of an eternal government monopoly on ideas) seems out of place in this discussion.

  16. Re:Short answer on Has Any Creative Work Failed Because of Piracy? · · Score: 1

    In defense of the future, $3M should go a lot farther in 2025. CGI is always getting cheaper, and the amount of freely available 3D models can only increase. By 2025, you could probably have a computer do a lot of the voice acting as well. Of course, all that means that the $3M "big budget" movies are going to be competing with the $30K movies that the SciFi channel is now running. But who watches those? They're crap.

    My feeling is that the future is going to suck for content creators. It's never been easier to create interesting, valuable things, but getting your cut of that value is going to be hard. On the other hand, the schemes being proposed by big media players give me a "chopping off a limb to cure a hangnail" vibe. They'd cripple the Internet and force cumbersome DRM into every piece of electronics you own. I suspect that the free flow of information is more important to our society than a paid creative class.

    If those sound like fighting words, they're not. I'm just scratching my head looking for a solution that works for everyone, and coming up blank.

  17. Re:Two-edged Sword of Technology on Has Any Creative Work Failed Because of Piracy? · · Score: 1

    I think both edges of the blade make life harder for the artist who wants to get paid. Both make them harder to charge for material. The first means that, whatever price you set, people can refuse to pay it and still access it. The second means that any material you want to charge for is in competition with a much, much larger body of work, much of it legitimately free.

    Also, smaller budgets would seem to mean less assistance for artists from labels, which means the artist is more likely to try and go it alone.

    Not that the labels can save all that much. It's hard to get costs down on things like recording studio time, sound editing work, etc., because you can't get rid of the labor costs.

    Allow me to place my bets on the future of creative work:

    * A vast increase in the quantity of creative material

    * Fewer gatekeepers, more filters

    * More unsigned/self-published creators

    * A slow decline in the importance of traditional publishers, which will be pretty much governed by the importance of those distribution channels that they still control, and their ability to turn already-hits into super-mega-hits.

    * More piracy, and better, more convenient tools for finding pirated content

    * An upsurge in very talented artists who have to hold down "real jobs"

    * The stuff you read/hear/watch/use will be less polished, but more targeted to your interests

    I think the era of paying real money for the sort of work that can be done by a single, talented writer or artist (as opposed to, say, the collective effort of a team of thousands) is drawing to a close. It will take decades, so there is little risk of me ever being proven wrong. But you're competing on fairly equal footing with people who do their work out of love, and don't really care if it pays off. You're competing with everything that has ever been written, sketched, or sung since the dawn of time. And as technology simplifies the process of matching people with the creative work that would most interest them, that competition will only get more intense.

    I think the future will be pretty good for consumers, kinda sucky for artists who want to get paid, and awesome as ever for the relative handful whose works gather a huge following.

  18. Re:Wrong. on Has Any Creative Work Failed Because of Piracy? · · Score: 1

    Bottled water is a bad analogy. There are a few legitimate reasons for buying bottled water (portability, for example). But probably 95%* of bottled water sales are due to people wrongly perceiving tap water as inferior. It's as if the only reason people bought MS Word was because they thought OpenOffice would reformat their hard drive.

    * Citation needed.

  19. Re:Let them eat laptops! on OLPC's XO-1.75 Laptop To Have a Multitouch Screen · · Score: 1

    It may be easy for you -- from the safety of your mom's basement -- to blame the ills of the third world on poor governance and high crime. But those things don't exist in a vacuum. Public safety is something that wealthy societies generally buy with their tax dollars. Prisons cost money. Rehabilitation programs cost money. Alternatives to poverty and desperation -- like job programs, job training, unemployment insurance, and welfare -- cost money.

    Now, your job as Personal Responsibility Man is to explain how the impoverished country should raise that money,* or explain how their society can cut crime without bulking up their public sector. Because what you've proposed so far is exactly what people of your ilk accuse liberals of doing: trying to create a better society through obnoxious nagging.

    Not that we Westerners are in any position to scold. We are responsible for much of the trouble in the third world. Imperialism did great damage back in the olden days. But the thing is, it never really went away. It evolved in its character, but the fundamentals remain: We extract the labor and natural resources of less advanced countries for pennies on the dollar. We do so because it's much cheaper to bribe a few with obscene sums of money than to bribe an entire population with education, medical care, etc.

    We happily loan billions to dictators, knowing full well that the money is probably headed to the Caymans, and not to build the infrastructure that would help them pay off those loans. But when the dictator gets kicked out, the population is still on the hook for our bad faith loans. The money they spend servicing their debts is money that won't be spent on their own needs.

    It must be kind of nice, going through life able to ignore the plights of others, because you've determined that they have only themselves to blame.

    * Without raising taxes, I presume.

  20. Re:Let them eat laptops! on OLPC's XO-1.75 Laptop To Have a Multitouch Screen · · Score: 1

    It's a bird! It's a plane! It's Personal Responsibility Man! Faster than a speeding bullet! More powerful than a locomotive! Able to leap intractable problems in a single round (of blame-the-victim)!

    Scene: A woman is being held up at gunpoint. Personal Responsibility Man is flying overhead. He lands.

    Mugger: Oh, no!

    Woman: Thank God! Personal Responsibility Man! Save me!

    PRM: You know I don't do that, miss. You must be thinking of Superman. Unlike that bleeding heart liberal, I help people help themselves. Much more effective that way.

    Woman: What do I do?

    PRM: Simple. First, shout something to distract your attacker. Like, "Officer, help!" Then, when he takes his eyes off you, deliver a kick to the knee, then grab the gun with a twisting motion. It's easy!

    Woman: That's crazy. I've never taken self-defense classes.

    Mugger: I have.

    PRM: Er, well then. You'll have to talk your way out of it.

    Woman: [hesitant] Okay. Um... I'm barely making ends meet. If you rob me, my landlord will throw me out on the street. I have a little girl.

    PRM: Very persuasive.

    Woman: You think so?

    PRM: Absolutely. I mean, if you're trying to convince a communist. [whiny high-pitched voice] Oh, please mister criminal! Don't rob me, feel sorry for me instead! [/whiny] He's a mugger, for Rand's sake! He already knows he's screwing you over. You have to explain to him why mugging you isn't in his self-interest.

    [Mugger is beginning to look bored.]

    Woman: Ooookay. Look, aren't you afraid of getting caught?

    Mugger: [shrugs] I guess.

    PRM: [whiny] Aren't you afraid of getting caught? [/whiny] By who? How dare you foist the job of bringing this man to justice off on the rest of us? His crime is against you, not "society" or some other liberal claptrap. I should just let this guy rob you and be done with it.

    Woman: That seems to be what you're already doing.

    PRM: [sighs] Here's what you do. Point out to him that he's unfairly expropriating wealth that he did not earn, and that the proper foundation for society is the free exchange of value for value, unencumbered by government regulation and bureaucracy.

    Woman: [resigned] Yeah. What he said.

    PRM: Good. Now, offer him a compromise which allows him to give as well as receive value. Like, have him reshingle your roof or something.

    Woman: But I live in an apartment.

    Mugger: And I'm no good at construction. Can I take her wallet now?

    PRM: Wash your car?

    Woman: No.

    PRM: Babysit your kid?

    Woman: [horrified] No!

    [They stand there in silence for a few moments.]

    PRM: You know, it was really stupid of you to cut through here after sunset.

    [Woman nods.]

    [A police officer walks by.]

    Officer: What's all this, then? [For some reason, the officer has a British accent.]

    [Mugger runs.]

    Woman: You saved me!

    PRM: You fool! How will this good citizen ever learn to defend herself if she suffers no consequences for her poor decisions and lack of preparation? You're just teaching her dependence! Socialism!

    [Officer and woman exchange an annoyed glance.]

    Officer: Walk you home, miss?

    PRM: [grumbles] My tax dollars at work.

    [flies off]

    PRM: I mean, if I paid my taxes.

  21. Re:Hmmm... on Police Stop Journalists From Photographing Metrorail System · · Score: 1

    You cut and pasted one of the video comments on YouTube:

    harleykman 5 hours ago

    That guy's an agitator. It's one thing to be minding your own business and suddenly the cops start making your life miserable, so you stand up for your rights. It's something else entirely to drive-round looking for police cars & then purposely make yourself a nuisance. That's called "trolling" or baiting. AKA being a dick.

    There is an irony in that last sentence.

  22. Re:Subsidy? Wrong approach. on Obama Awards Nearly $2 Billion For Solar Power · · Score: 1

    If you can say that there are no costs associated with CO2 emissions, then you're saying there is a 100% certainty that global warming is a hoax.

    If you can say that, you're either a liar or deep into denial. Either way, good day, sir.

  23. Re:Subsidy? Wrong approach. on Obama Awards Nearly $2 Billion For Solar Power · · Score: 1

    You misunderstand what I mean by "energy efficiency." You're talking about the conversion efficiency of solar panels, which is pretty irrelevant, since even low-efficiency panels could power most homes using existing roof space. In fact, cheap, inefficient panels are probably better than expensive, efficient ones in most cases.

    When I talk about energy efficiency, I mean investing in design and technology that allows us to get far more use out of every watt we produce. Take cars, for example. The average car has about a 10% efficient internal combustion engine, and weighs ten times what its human occupant does. So about 1% of the fuel I burn while driving around actually performs the useful work of moving my carcass from point A to point B.

    In contrast, I also have an electric bike. It weighs about 40 lbs, and including the inefficiency of charging has an efficiency of maybe 70%. Do the math, and you find that over half the energy put into the system actually does useful work, making it more than 50x more efficient than my car.

    That's energy efficiency in a nutshell: making sure that more of the energy we use performs some valuable service. We're facing a national decision with a single home analogue: Say you're a homeowner who is deciding to install solar on your roof. You call in two separate installers for estimates. One says that he can get you a 30K system that will cover all your current energy usage. The other looks at your energy bills and your current infrastructure (light bulbs, appliances, etc.) and points out several things you can do to lower your energy bill: put LED bulbs in all your fixtures, replaced your old freezer with a more energy efficient model, exchange your watt-hogging computer with a laptop, replace your electric dryer with a natural gas one (or better yet, a clothesline), and installing a swamp cooler to take some burden off your AC. Doing all this would reduce your energy usage by 50%, at a cost of $7000. So you could get by with a $15K system that would serve your newer, lower energy needs.

    What should you do? The obvious answer (make the infrastructure investments, and buy the smaller system) is wrong. What you really ought to do is make the energy investments, tell both installers to take a hike, and loan the money to your neighbors so that they can make the same sorts of efficiency investments. I'm a big fan of alternatives, but I think they tend to overshadow the much cheaper carbon-cutting alternative: not having to generate the energy in the first place.

    There are so many investments we could be making right now that would actually have a positive return on investment, it's not even funny. One report I recall said that a $60B investment in building efficiency would remove a gigaton of CO2 from the atmosphere every year for decades. That would imply that, if cap and trade were passed, with a cap of a gigaton below current emission levels by 2020,* it shouldn't cost the economy more than $6B/year, which further implies a per ton carbon price of about $1/ton for the first decade. That minuscule number doesn't even factor in the money that the building owners will be saving on energy bills.

    In short, cap and trade might not cost *anything* for the first decade. So perhaps you can understand why I don't buy the whole "OMG REGGILAYSHUNS TACKSES MY SKY IZ FELLING!" meme.

    I'm still in opposition to your specific plan. I think there is a place for government to add some certainty to solar investments by buying in bulk. But with a regulatory approach, you can change the investment landscape at a relatively low price, diverting a large flow of private investment without the government needing to touch that money directly. If they take a buy-only approach, they'd have to buy a *lot* of panels to have an effect. So the choice doesn't seem to be between big and small government, but between high-taxes/low-regulation and low-taxes/high-regulation.

    The illegal drug market is an obvious candidate for a black market. I don't

  24. Re:Loan guarantees on Obama Awards Nearly $2 Billion For Solar Power · · Score: 1

    Re: your last paragraph. No, Kyoto was right to focus on the actual goal (lower CO2 emissions) rather than one part of the means of getting there (generating more clean energy). One fact gets overlooked both in this discussion and in the broader policy discussion: It's usually way, way cheaper to invest in energy efficiency than new power generation. That's just one of the reasons why I think a solid cap-and-trade system makes more sense than things like technology-specific subsidies and renewable portfolio standards.

    By the way, $2B is chickenfeed compared to our overall energy infrastructure. The idea that "business" would have to pattern their energy consumption around the couple of plants involved in this deal seems hyperbolic to me.

  25. Re:Can somebody say on Obama Awards Nearly $2 Billion For Solar Power · · Score: 1

    As we've learned, getting troops to a country is easy. Occupying and controlling the country is hard. I think we could disband the Department of Defense entirely for a decade, and we could fight off any invasion solely on the strength of our former soldiers and private arms. If we (the highest-spending military behemoth on the planet, by a factor of ten) couldn't control Iraq (an area smaller than Texas, with a population of about 20M), how the hell is China going to invade and control us?

    Besides, the GP wasn't making a serious proposal (any more than I am). He's just pointing out how truly screwed up our spending priorities are right now. I'm sure he'd be ecstatic with, say, a 50% reduction in military spending.