Slashdot Mirror


User: Karmashock

Karmashock's activity in the archive.

Stories
0
Comments
10,236
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 10,236

  1. Re:Obligatory on US Army Website Hacked By Syrian Electronic Army · · Score: 1

    I am... Perfect security possible with computers. You can make things that are unhackable.

    It needs to be simple enough to debug, elements that don't change should be made literally static... ideally physically locked, and anything hyper secure should be either encrypted with perfect 1:1 encryption or airgapped. That's if you want PERFECT security. Which again... is possible.

    Its like anything that is perfect... either very simple or nearly impossible to do. Make it easy on yourself by making it simple.

  2. Re:And here's the proof on Amazon Hiring Devs For Its First PC Game · · Score: 1

    yawn... did you have a credible claim against amazon or just further proof that AC's shouldn't be able to post due to statistically low IQ?

  3. Re: Harvard is the right place on Everyone Hates Harvard · · Score: 1

    First, the letter just said that any agreement Obama struck with Iran would either have to be ratified by congress or it wouldn't be enforceable past Obama's presidency. That's just a fact. There is no negotiation there. That is just reminding the Iranians how US law works.

    Second, several democrats have done similar things throughout the years. This is my personal favorite:
    http://www.forbes.com/2009/08/...

    Third, I don't think you understand what "treason" means:
    https://www.law.cornell.edu/us...

    ""
    Whoever, owing allegiance to the United States, levies war against them or adheres to their enemies, giving them aid and comfort within the United States or elsewhere, is guilty of treason and shall suffer death, or shall be imprisoned not less than five years and fined under this title but not less than $10,000; and shall be incapable of holding any office under the United States.

    LII has no control over and does not endorse any external Internet site that contains links to or references LII.
    ""

    THAT is treason. Penning a letter to Iran which is something anyone in the US can do by the way... we do have freedom of speech which extends to sending letters to other countries. US senators and congressman can absolutely send letters to other countries and they do so all the time.

    It is not treason unless you do so with the intent of undermining the United States.

    Undermining a particular treaty you don't agree with is not treason. And if it were, a lot of democrats would have died in jail or been executed.

    They weren't because it isn't treason. Its annoying when it happens but that's US politics for you. This isn't against our laws and the people that suggest otherwise are ignorant. Again, if it were against the law, then people would have gone to jail.

    No one went to jail because it isn't illegal much less fucking treason.

    As to the logan act, it isn't enforced if they did violate it. Again, senators and congress people make contact with foreign governments without authorization all the time. Both parties. Do you honestly think the democrats didn't try to undermine any Bush Jr's foreign policy by contacting other governments? Don't be naive.

  4. Re:Obligatory on US Army Website Hacked By Syrian Electronic Army · · Score: 1

    hacking a dns server doesn't touch the military webserver. That is bypassing it and hacking public systems to redirect you.

    Quite different.

  5. Re:Obligatory on US Army Website Hacked By Syrian Electronic Army · · Score: 2

    emmm... not really. just because there isn't secure information in there doesn't mean it is "okay" that it got busted.

    First there is a question of prestige here. You don't let shitstain hackers break into your webserver. You just don't.

    Second, I'm not sure there was nothing in there of value. It could have contained something that would point them at other systems or give them deeper knowledge of the infrastructure of another network. And they could leapfrog from one to the next.

    It definitely was a breach... a breach into a place with no secure information? Possibly... but still a breach. And you don't let a bunch of kids into mil space.

    All I'm saying... secure your webservers. Please.

    I was dealing with a company webserver that was getting breached every couple weeks. It was constant. Nothing was in it that mattered but people were getting into it and fucking it up.

    I talked to the guy responsible for it and he wasn't making any sense. He was saying it wasn't possible to keep people out of the fucking thing. Which just told me that he wasn't competent to do the job. Period. I talked to someone else and explained some of my ideas as to how to secure it, they said "those will all work"... I then put him on that, we secured the system the way I wanted to do it.

    It hasn't been breached since. What I did do? A lot of things. But the most extreme thing I did... because I'm a kitchen sink sort of guy that throws fucking everything at anything that gives me a problem... I write locked the server. You literally can't change anything on it. All the parts of the system that are fucking word press or other similar code that was getting screwed with is write locked at the file system level. It doesn't need to be changed on a regular basis. We move something around about every three or four months maybe. And all the web admin has to do is trigger a script that unlocks the files, then he can do what he wants, then he triggers the script again and it locks all the files behind him.

    This is an issue I have with stuff like word press. Its really nifty but its got lots of ways to hack it or get into admin functions.

    And my attitude with that, is that you need to understand the portions of the system that change and the portions of the system that don't. Then you only permit the segments that need to change to change. And the portions that don't can remain locked.

    You do that, and most of the pure word press hacks and exploits don't work. They don't anticipate the configuration files being write locked.

    Again, not the only thing I did... but one of the most demonstrative of the core concept... which is to make hacking a system LITERALLY impossible.

    Here someone will say "well not literally they could get in and unlock the files at the file system level."... sure... if it is possible to do that... which long story short, it isn't.

  6. Re:Obligatory on US Army Website Hacked By Syrian Electronic Army · · Score: 1

    Hmmm... they actually did get into the webserver... it wasn't just a DDOS attack or something. They actually got in.

    Now did they get anywhere near anything we care about? Probably not. But they did get in to something.

    Possibly read it this way:

    "vandals broke into a sign put up by the US military and changed the letters around to say POOP"... they did get in... just... to a place no one cares about.

  7. Re:It doesn't matter matter who did it on China Denies Responsibility For US Government Data Breach · · Score: 0

    Wait wait wait wait wait....

    So I'm right? I said X is how it is done.

    And you respond with "Of course X is how it is done, I can't believe you didn't know that that is how it is done."

    What you're not getting is that my point is that non-technical people are put in charge of computer systems. And you said I was wrong... and then I showed you a big example of it... and you said "of course"...

    So I'm right.

    Thanks! We're done. You bore me.

  8. It usually does... on Computer Modeling Failed During the Ebola Outbreak · · Score: 1

    Computer modeling is vastly overrated. It is mostly based on the abstraction of trend lines. Which is the assumption that existing trends will continue. That is less a prediction of hte future than a picture of the present.

    Look at the growth trend line of a six year old... then graph that out... in 10,000 years think how big he'll be!

    Right?... that's what trend lines do... They're only useful if people that know what they are and how they work use them. Often as not, people that aren't educated or knowledgeable enough to deal with them get put in positions where they can make determinations about stuff using those trend lines.

    And it generally leads to a shitstorm of stupidity.

  9. Re:This is why you do background checks on TSA Fails To Find Links To Terrorism of Airport Workers · · Score: 1

    Its not well advertised or encouraged.

    It should be the default system that everyone goes through except for infrequent travelers. Anyone commuting by air or taking business trips or just traveling with any frequency should be able to bypass the system.

    And people that apply for visas should be encouraged to do this as well. Any excuse we can come up with to subject people coming into the country to an additional layer of scrutiny is something we should exploit.

  10. Re:Fees increase with subidies on Writer: "Why I Defaulted On My Student Loans" · · Score: 1

    Wrong. it isn't the other way around.

    The rise in costs would be attributable to cost of living, inflation, professor salaries, etc.

    There is no correlation between tuition and those variables.

    what you're probably getting tripped up by is that the government subsidy never quite seems to cover 100 percent of what the university charges.

    You missed what I said. They don't charge you what the subsidy is... they charge you the subsidy PLUS what they think you can pay on top of it.

    So if the government offers X and X used to be what the tutition was... they'll ask for whatever they think you have in your pocket PLUS X.

    Increase X and they'll just keep charging you X + what is in your pocket.

    Increasing X will never have you with no out of pocket expenses. Make X one million dollars... they're still going to make you pay for shit out of pocket because the want the money in your pocket as well.

    Another thing you could do to control costs is instead of give people money that can ONLY go to the college, instead give them money that they can spend on ANYTHING.

    Does that mean that irresponsible people will spent the money on hookers and booze? Yes. But you can structure it so that it is harder for them to do that.

    The idea though would be to encourage the student to NOT spend more money than they needed to spend. So maybe look at what the colleges and universities cost and then using that to judge which one you want to go to.

    Going to a cheaper school for undergraduate work for example is a good idea. Ivy League undergraduate courses are over rated.

    If kids KEPT money they saved by going to cheaper schools they would put cost pressure on the schools to keep costs down to attract students.

    This is a basic concept in economics. No one really has any excuse for not understanding it past high school.

    You can do the same thing with medical insurance as well.

    Some medical insurance policies have fixed payouts when you are hurt. They don't pay the doctors or the hospitals but they pay YOU. So if I get 10 grand for having this confirmed problem... any money I save by keeping the costs of treatment down is money that goes into my pocket.

    Again, yes... fraud is possible here but there are ways to make that less of an issue.

    And I should point out that the alternative has the fraud happening at the universities and hospitals instead. All things being equal, I'd rather have the patients ripping the system off than the institutions.

  11. Re:It doesn't matter matter who did it on China Denies Responsibility For US Government Data Breach · · Score: 1

    Saying that employees need general access to the internet is hard for me to believe. In most cases they don't.

    And really some distinction should be made between high security environments and low security environments.

    So for example, I'm quite happy to set up an alternate wifi network that is largely unrestricted. Any machine that connects to that network will be airgapped from the secure systems.

    if you want to facebook on that network with your own machine that is fine. You will have no access to the file servers, corporate email, or the databases from that network.

    I've seen employees use their phones to access the open wifi network and check their social media bullshit. I'm fine with it. But you don't do it on the company system. Or I will cut you.

    As to what level of security you need... the issue is do you care if you get breached or not? That's the question. This sort of security is not expensive. It takes discipline more than anything. But its not hard to set up and actually easier to maintain. No worms. No viruses. No malware. No idiot employees fucking the machines up. You really don't have to do anything once you've see it up actually. You can just go on vacation.

    My job mostly consists of telling people "no" at this point. They say "can I install my bullshit on my workstation?"... No you can't. Any further stupid questions? And the ask me because they TRY to do it first without asking me. The systems won't let them so they come to me and say "hey can you unlock the machine"... and ask them what they want it for, and then tell them that any request for additional shit on their machines has to be approved by management.

    Since what they tend to want to install is itunes or something... you can imagine that their managers etc are not especially inclined to back them up.

    We provide a few literal gaming machines in the break room... with steam accounts that have quite a few titles and I'm happy to add stuff to the list so long as people are reasonable about it.

    On your break you can go in there and do what ever you want on those machines. They're rarely all full and I have have an isolated wifi network that anyone in the office and use with their own laptops/phones/tablets to do whatever the hell they want.

    The workstations don't even have wifi cards in them and will not permit the installation of wifi card drivers without my permission. Had a guy try to plug a portable USB wifi dongle into a workstation. He came to me and asked why it wouldn't work.

    I was polite to him... but there was a part of me that wanted to tie him to a pole and give him at least 30 lashes.

    As to tens of thousands of employees... wrong. You do not have tens of thousands of employees. You have user permission levels.

    So lets say the accounting department needs access to the corporate database. Okay, what sorts of people work there and what kinds of access do they have? You break people down into groups. And then you give the groups access to things.

    You do that and it scales quite nicely. Its very manageable.

    I have workstation templets for perhaps 20 different user loadouts despite having well over a thousand users. And nearly all the user templetes are for management people that just want exceptions and have enough clout to demand it.

    Nearly all users use the same template. Literally about 95 percent of all my users are using ONE template. So I don't have to worry about checking on what 10,000 employees are doing. I just need to check ONE template.

    What is more, whenever they try to do ANYTHING that isn't authorized, it gets entered into a log file. Literally anything. They try to get access to a file they don't have access to.. .they try to access the internet to do something they're not supposed to do... anything and it gets put in a log file.

    The scripts that run that process will sort the log by the severity of the issue. I glance at the logs every week or so. But the systems will send me a text message when

  12. What is the future of cyberlockers? on Interviews: Ask Kim Dotcom a Question · · Score: 1

    Seems the government can take them over, harass the devs, etc... so what is the future of them?

    Is the best we can hope that you can set up new ones faster than they can destroy the old ones? Or can you establish a stable platform that can't really be attacked?

  13. This is why you do background checks on TSA Fails To Find Links To Terrorism of Airport Workers · · Score: 1

    the whole TSA security model for is ass backwards.

    Rather than anally probing the passangers, do a background check... on all of them. Make that a part of the security process.

    Have two lines.

    Line one is for people that went through a background check. They can go through a metal detector, with their shoes on, thank you have a nice day.

    Then you have another line for people that didn't go through a background check and they get to take their shoes off etc.

    Let everyone that wants to go through the faster line pay the government 20-50 bucks for a background check and then we're done.

    All the frequent fliers will have the new card and will just bypass most of the security.

    This is how it should work.

    And obviously anyone actually working for the TSA would be expected to go through a fucking background check.

    Here someone will say "they did but no one noticed they had terrorist ties"... then you're apparently hiring circus monkeys to do the background checks. Hire human beings to do it. Next issue.

  14. Re:It doesn't matter matter who did it on China Denies Responsibility For US Government Data Breach · · Score: 1

    Its not a question of being connected to the internet. It is a question of firewalling that connection so that only communications you approve of can flow through it.

    And then setting up the computes so they can only run approved executable code. These things can be done. I have done them.

    As to people that need to use google, what do you use google for?

    1. Do you use few specific websites or do you need access to ANY website? I would argue that if you had to sit down with your security team and tell them EVERY site you needed access to it would be a finite list. I would then specifically give YOUR machine or which ever machines or users needed access to those domains access to those domains. And that access would be restricted to port 80 which is websites, and only your browser would be able to access them.

    Do you see? A virus or worm couldn't contact its master under that system unless its master was one of those domains you cited. And even then it wouldn't be able to connect unless it was using your web browser to do it. And even then, you'd have to be logged in on your account to even give your browser that authority.

    A worm that can get through that is something I've not seen yet. They just don't. The worm has to infect the server, the router, the the firewall to get out under my system. And that isn't happening because I don't permit workstations to send anything to those systems that is not authorized by me. So the worm can't spread its infection to security controlling infrastructure and it can't access the internet because I don't give workstations more privileges then they need.

    I use VPNs not only externally but internally within. You want to access the database or the file server? Fine... login to the internal VPN and you can do that. The communications between that system and your system are encrypted and the protocol is tightly controlled. You can't do anything besides what I what I let you do.

    2. Beyond that, I like to use terminal servers so your workstation is in most cases a template sitting on a terminal server and it refreshed from the template after every logout. So even if you infected your workstation, simply closing it and opening it again will remove the infection.

    3. And you're not going to infect the workstation because I'm not going to let you run executable code on it that I haven't approved. what do you need to run? Your webbrowswer? Your email client? Some word processor? A a spread sheet program? Access a corporate database or three? Fine. You can run all of that. But I will grant access to each of those specifically.

    I don't even let my users run notepad. They don't need it. They can't run minesweeper... ti isn't even installed but if it were they couldn't run it. They can't run ANYTHING that I have no specifically authorized. The System account has authorization to run most things but the USER account can only run perhaps 10 programs total at most. Nothing else. They can't even open a command prompt. You can't do shit on those machines unless I specifically allowed it.

    And while you might be thinking "wow this guy is a control freak"... that is my fucking job. I control the systems. they do what I want and nothing else.

    I am a big believer in what I call "white list security"... Most people use what can be termed "black list security". they have huge lists of all the things you can't do. That's how an anti virus program works. It looks for bad code and disallows it from running.

    I do the opposite. I identify GOOD code and permit that to run. All code that is not good and approved is passively denied access. No exceptions. that means I am immune from most zero day attacks. The new virus or worm or whatever simply won't run.

    And even if some crazy how you do infect one of my systems it will purge the infection on log out because the entire template is refreshed. And even if some crazy how you survive that, you're not getting through my firewalls.

    What I'm trying to make clear here, is that contrary to yo

  15. Re: Harvard is the right place on Everyone Hates Harvard · · Score: 1

    High treason huh? For what? Cite it please. And I'll show you democrats doing the same thing. What is being cited as high treason is not high treason. If it were, they'd be charged with high treason.

    Theyr'e not because it wasn't.

    I'm stopping there. Your opening comment was so dumb that I don't have interest in going further unless you admit it was bullshit.

  16. Re:It doesn't matter matter who did it on China Denies Responsibility For US Government Data Breach · · Score: 1

    As to them not putting technical people in charge of security... okay:
    http://en.wikipedia.org/wiki/D...

    That's a naval admiral in charge of the NSA.

    Think about that.

    Do we put anyone in charge of the Navy except for people with naval experience? No we do not.

    So why do we put people with no computer experience in charge of the fucking NSA?

    And that sort of thing is typical. Now... am I going to get any more back talk out of you? Do you have a legitimate comment you'd like to offer? Or can I expect more bullshit from you?

    Three options. You accept my point, you offer a counter argument with EVIDENCE because I just presented some, or I get to take you even more lightly than I already do.

  17. Re:PC is the only one that counts on Fallout 4 Will Be Skipping Xbox 360 and PS3 · · Score: 1

    Its written by the same people that did Fallout 1-2. So its much better. It also continues the story from FO2 unlike F3 which goes to the east coast for no reason and doesn't touch on anything you learned in FO1-2.

    There's more lore in NV than in FO3. If you like that. I do.

  18. Re:PC is the only one that counts on Fallout 4 Will Be Skipping Xbox 360 and PS3 · · Score: 1

    lolz. You don't need to put money into your PC.

    Look, you're going to have a PC regardless. So the cost of the PC itself is a zero sum game.

    The issue is what it does it cost to make a normal computer into a reasonable gaming machine? And the answer is somewhere between 200-400 dollars depending on how good the base machine is...

    I like faster computers. For just doing things. It makes everything I do on the machine faster. so I'm going to get a fast computer period.

    The cost of upgrading a fast computer into a gaming machine is the cost of a gaming video card. And that's something like 200-400 dollars really. its not a big deal.

    As to you liking to chill out... I have a really nice man cave. I have a fridge next to my computer... I'm good. I don't even do anything with the TV when it is just me. The TV is for company. For me, I'm going to be using my gaming laptop.

    Which is another issue. gaming laptops. I take my gaming machine with me when I travel. I have it with me. I don't have to deal with boring hotel entertainment. I don't have to deal with being bored on trips.

    The PC is where it is at for a lot of gaming. If you like the console... fine. To each his own. But PC gaming is if anything cheaper than console gaming and far more flexible.

    Another thing... I can play any game that worked on the PC pretty much ever. I can play old dos games on my PC. I can play emulated console games as well. You're locked to whatever your lords and masters let you play on the console. And tehy force you to rebuy stuff all the time. I only buy stuff that is new. Old stuff just works.

  19. Re:PC is the only one that counts on Fallout 4 Will Be Skipping Xbox 360 and PS3 · · Score: 1

    Blaming the parent company only goes so far. Developers have deadlines. If they're not hitting their targets... then the question is "are those targets reasonable?"... and if they are, then failure to hit them is on the devs.

    EA gets a lot of shit for killing companies they buy as well. But what people don't get is that when a company sells itself to EA they're basically making a choice in the first place. It often means the devs are ready to slow down and not spend so much of their lives making games.

    Sounds nice only that attitude means the dev company can't actually meet its deadlines. So they hire lots of extra people to cover for the few all star devs that are slacking off. This is very expensive. You sometimes need to hire 10 or so noobs for every all star that is napping. And you're often paying for both. This inflates costs, increases production times, and that requires the game do better at release because you're going through a lot of the publisher's money.

    If I had any complaint against most of the big publishers, it is that their development contracts are poorly designed.

    You need to write them in such a way that the developer respects the publishers time and investment. They'll often just take a briefcase of cash and then go on vacation. Literally.

    That is why a lot of those contracts go south.

    The most successful dev teams tend to be tight operations. They don't have a billion people working on a game. They keep it to what is reasonable. And they work really hard... they stay under budget... and hit their deadline.

    And they tend to be less buggy.

  20. Re:PC is the only one that counts on Fallout 4 Will Be Skipping Xbox 360 and PS3 · · Score: 1

    To each is own, the improved dialog of NV was so far beyond F3 that I have a hard time taking F3 seriously.

  21. Fees increase with subidies on Writer: "Why I Defaulted On My Student Loans" · · Score: 1

    Chart the cost of colleges against subsidy increases in the US. Just as with the housing bubble, you'll find that increases in subsidies increases the cost of college almost immediately.

    The reality is that college or a house or healthcare or a lot of things costs what people will pay for it.

    This is a basic economic concept that a lot of people don't seem to understand. Supply and demand.

    When you give students a big bag of money that they can only spend on college the money isn't theirs. They have no incentive to economize with it or pay what something is worth. So they just take that big bag of money and hand it to the university without thinking about it. There's no point doing anything else from their perspective. It isn't their money.

    Home sellers, universities, and the healthcare industry responds to this situation by increasing their prices to whatever that big bag of money is plus whatever amount of money they think you have in your pockets. So if you showed up with 10,000 in your savings... or that is what they think... and the big pile of money is 50 grand just as an example... they're going to ask for 60,000.

    We've seen a lot of different things increase their costs suddenly and at a much faster rate than inflation or reductions in supply. Housing is probably the clearest example of that. Yes, space is limited but the costs of housing basically jumped up to whatever home buyers COULD sell the home for. Of course. you're going to want to sell your home for as much money as you possibly can. But that means that every time the banks or the federal government just start giving people money for home loans... nearly all that money just goes to the profits of existing home owners. And it makes it much harder for people that didn't need to the loans before to afford homes because now everything is way too expensive to buy at that rate. Which pushes people that wouldn't have needed help into the same government programs.

    It is a vicious feed back loop.

    Here are a few ideas.

    1. With college especially, consider an investment model as an alternative. Liberal arts majors will hate this but it will deal with the feed back loop. The idea here is that rather than loaning people money, you instead INVEST in that person. You say, "in return for 10 percent of your income for 10 years, I will pay for your education." And the investment model would work like any investment. Your grades and career choice, and educational path, etc would all be factors in whether anyone actually wanted to invest in you are not. For STEM fields especially this would be very helpful and companies could even do it as a way to encourage people to get educations in things the company found useful. That 10 percent of your income could be the money they pay you to work for them. Thus it would mean a 10 percent reduction in what they have to pay you when you ultimately start working for them.

    Some stem jobs pay around 80-130 grand. So 10 percent for ten years works out to 80 to 130 grand for them.... minus whatever the education cost... minus the opportunity cost... minus the interest. Whether it made sense in any given situation would be a matter of spread sheets. But what is nice is that it links what an education is paid for to something "Real".

    And linking prices to anything REAL is a great way to control unrealistic feed back loops.

    2. In regards to housing, the only thing you can do is have the home buyer pay a large portion of the total cost of the house upfront. Typically no less than 30 percent. That is THEIR money. Not debt money. That 30 percent figure will stop a lot of people from buying a house but it will also make them not walk away from a mortgage and it will make them not buy a house that costs too much. If a house costs a billion dollars and I have to put up none of that money upfront... then I can own a billion dollar house for at least a month. And if the interest rates are really low then who ever needs to pay it back... right? The big mistake with the fiancial cris

  22. Re:PC is the only one that counts on Fallout 4 Will Be Skipping Xbox 360 and PS3 · · Score: 1

    hey bingo

  23. Re:PC is the only one that counts on Fallout 4 Will Be Skipping Xbox 360 and PS3 · · Score: 1

    black isle had people that could write dialog. Bethesda doesn't.

    It was way New Vegas was so much better. Obsidian, who are refugees from Black Isle... they did the development. And it was better.

    Even the DLCs were better... Dead Money was excellent.

  24. Re:PC is the only one that counts on Fallout 4 Will Be Skipping Xbox 360 and PS3 · · Score: 1

    If they let users install unsigned code on the systems then you can undermine the DRM.

    Simple as that.

  25. Re:How is this devoid of meaning? on On Managing Developers · · Score: 0

    I actually quoted the link and went through It line by line to show that it did. You refused to respond to that post. You just went back to making more specious claims like saying I said I was against all science in my first post in that other thread.

    I asked you to quote where I said any such thing. And the best you could do was a quotation where I said you personally were a piece of shit.That was your evidence that I was against science. That i thought you personally were garbage.

    You are garbage. ;)