Slashdot Mirror


User: KeithIrwin

KeithIrwin's activity in the archive.

Stories
0
Comments
271
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 271

  1. Re:Necessary Tool on Programming As a Part of a Science Education? · · Score: 1

    Out of curiousity, why would you assume that people who have never taken a single programming course would in fact have a "language of your choice"?

    It seems to me like you're really arguing that people who already understand the basics of programming don't need a course in the basics of programming.

  2. Re:Theatre is a great form of security. on What Examples of Security Theater Have You Encountered? · · Score: 1

    Yes, nothing's better than the sort of security which deters casual walkers-by, but lets in people who have something to gain by evading it.

    Is your logic that without security theater everyone would just constantly be hijacking planes and bombing parliament? I mean, you seem to be saying that security theater prevents the 99.9% of people from doing bad things, but, let's face it, most people don't have any urge to do this sort of thing in the first place. They would be deterred from doing it if you told them that they'd get a stern talking to.

    But more to the point, you're misunderstanding the goals of security theater. People weren't allowed to take nail clippers onto airplanes after 9/11 not because it would deter terrorists. Nail clippers were banned to give people the impression that something was being done and that they were being kept safe even though they weren't actually any safer than before. Security theater is unlikely to deter anyone who is actually going to plan an attack. They'll just look at the system, see the gaping holes, and attack there. It's purpose is so that people using the system who aren't planning an attack will look at it, say "gee, this system looks secure, I guess I/my family/my money/whatever will be kept secure here, so I'll use it."

  3. Re:Credit cards. on What Examples of Security Theater Have You Encountered? · · Score: 2, Insightful

    If the card specifically says "please ask to see id" I doubt that very many clerks would accept the "it's my husband's card". Generally speaking, most stores will not take a card unless they believe that it belongs to the person presenting it. If they can show ID with matching last names, then maybe, if you're lucky they'll take it. Generally, people who share credit card accounts get separate cards with their own names on them. They don't use other people's cards.

    Using the card at an ATM requires a PIN number. They aren't going to know your PIN number. There are special credit-to-cash machines in some casinos which process a credit card charge and then give you 95% of the money, but those are not very common outside of casinos, so for those of us who don't live near a casino, it imposes an additional delay.

    Using it over the internet usually (although not always) requires the billing address associated with the card. The reason they require this is because it is something that the cardholder knows that someone who stole the card or found a lost card probably doesn't know.

    Admittedly, writing "Please Ask to see ID" doesn't offer any improvement over signing the card in the later two scenarios, but just because a security measure doesn't help in all possible situations doesn't mean that it isn't an improvement, especially when those situations are less common anyway.

    In the end, what it comes down to is:
    1) Signatures are easier to fake than IDs are, especially when you have an example of the signature to work with. Most store clerks, even if they check, are not knowledgeable enough to recognize the difference between someone's real signature and a copy. Making it worse is the fact that the signature field on a credit card is only about half the height of most people's normal signatures, so the signature in the field often doesn't really resemble the person's signature.
    2) Even people who don't check the signatures sometimes notice the "Please Ask to See ID" written in the signature line. Several times I've seen clerks not check signatures for people in front of me, but then, when I hand them my card to swipe, they notice what's been written in the field and ask to see my ID.
    3) In most states, the driver's licenses have the signature on them, so they can still check the signature even if the card doesn't have one on it.

    So, sorry, but this legitimately does make it tougher to use a stolen credit card, whether or not it's inconvenient to you.

  4. Re:Credit cards. on What Examples of Security Theater Have You Encountered? · · Score: 1

    Wow. This is post really reflects what Bruce Schneider was saying the other day about the difficulties of teaching a security mindset. This poster is clearly thinking about how the security measure works when nothing has gone wrong, but the security measure is meant to effect things when something has gone wrong.

    People don't sign their card "Please ask to see ID" because they don't want to put their signature down. It's not some kind of security blanket for when everything is going well. It's so that if their card is lost or stolen and someone else tries to use it, it will be more difficult for them to do so since they won't be likely to have ID with their picture and the credit card holder's name.

    It's not a guarantee since ID can be faked and credit cards can be cloned, but it at least makes it more difficult for fraudsters and means that the mean time between acquiring a credit card and being able to use it fraudulently is longer, increasing the odds that the card will be canceled before being used.

  5. Re:Pretty normal on Getting Credit for Programming Accomplishments? · · Score: 1

    As for working 80 hours a week for a 40 hour a week job, well, perhaps they expected to work 80 hours a week and factored that into their pay. If management expects and demands the extra hours, then they can leave if you don't like it. If management doesn't demand those hours, than putting in the extra hours can help management come to respect you as a hard worker. Or think that you're a gullible idiot who will accept 40% of the agreed upon salary relative to the work being done. If you do 80 hours work normal overtime rules (which don't legal apply but are still a good guide as far as worth) would suggest that you receive 100 hours pay. If you're receiving 40 hours pay, you're selling yourself way cheaper than you ought to be.

    If they really did negotiate a salary for an 80 hour work-week upfront, that's obviously different, but a lot of people wind up with long hours because their employers intentionally mislead them about the job requirements. That's fraud, but it doesn't generally get prosecuted.
  6. There is research on this area on Shape-Shifting Malware Hits the Web · · Score: 1

    It is definitely the case that metamorphic and polymorphic malware is becoming more commonplace, but there is research being done on how to characterize it and detect it. My friend Qinghua Zhang is finishing her PhD thesis on just this topic. There are lots of open research problems, but we shouldn't pretend that static signature matching is the only solution just because it is the most widely deployed one.

  7. Re:Enumerating the Bad is not a good idea on Shape-Shifting Malware Hits the Web · · Score: 1

    There are numerous difficulties in successfully characterizing what good behavior is. Viruses generally attack a program by getting it to execute data as code. This means that what's running, much of the time is the installed software. Making it difficult to install new software would be helpful, but doesn't prevent malicious software from running in memory.

    There is research into intrusion detection techniques which is being used to attempt to characterize what "normal" program behavior is and notice when anomalous behavior occurs. However, it is difficult to get the false positive rate low enough for it to be practical.

  8. Probably not very on Peter Gabriel's Web Server Stolen · · Score: 5, Interesting

    There was a talk at ACM CCS a couple of years ago by a guy who specialized in physical security. He runs a company which works as site security testers. He told of being hired to check how secure a client's computers were in a "secure" data-center. The servers were in a floor-to-ceiling cage with a padlock and security cameras. All they had to do was to fake some passes to get into the data center and then either go under the floor or over the ceiling. In this data center, as in most, there was about a 2-foot crawlspace below the floor and another one above the ceiling. Floor-to-ceiling cages don't mean much if you can just go around them, and that's how many "secure" data-centers are set up. Likewise, the security cameras are only useful if someone is watching them, and in the places he tested, no one was. Since he was only testing, he didn't actually steal the machines, but he did put stickers on them to prove that he'd been there.

    So, how secure is your data center: probably not very.

  9. Re:How green is it? on Home Wind-Power Turbines Make Headway · · Score: 1

    Many US states also have what they call "net billing" laws which say that if a consumer generates power which is then put onto the grid, this can be used to offset the power they consume and the consumer will be charged only for the net amount of power consumed. Another way to look at it is to say that the power company has to buy power from the consumer at the same price that they sell it. This guarantees that all the power you produce will be economically useful to you.

    Unfortunately, there are also some states in the US which don't have such laws.

  10. New York is not a leader. on New York to Implement an 'Amazon Tax' · · Score: 1

    What's with this "Experts predict that other states could follow suit with similar provisions" bit? Only if said experts are idiots. Everyone already knows that most states have use taxes already. New York must be one of the last states which doesn't.

  11. Re:they can pass it all they want... on New York to Implement an 'Amazon Tax' · · Score: 1

    Most states claim that the use tax applies to all items, but you can deduct the sales tax as an offset to the use tax. So, in practice it only applies to items from out of state and the sales tax applies to in-state items. Although I will note that most states will allow you to deduct sales tax paid to other states from the use tax as well, so that at least it's not tax upon tax when you buy something from out of state.

    Thus far, the courts have upheld this practice, which frankly, seems ridiculous to me.

  12. Re:Will Slashdot Ever Get It? on Amazon Sneaks One-Click Past the Patent System · · Score: 1

    I remember the state of e-commerce in 1997. It was obvious then too.

    Being able to do something like that was the whole point of cookies. When, in 1995 or 1996 (i.e. during my sophomore year of college), my friend asked me what use cookies would be, I gave the example that it could be used for one click shopping. He was confused about what the use of such a small amount of data could be and I told him that it could be a key in a database to an entry containing a user's name, address, and credit card information, thereby allowing a single click to place an order instead of the silly forms which we were having to fill out and re-fill out in order to buy things on-line.

    I'm not patting myself on the back for having been clever. It was an obvious application of the technology at the time. And the passage of time has not made it somehow retroactively not obvious. Just because you didn't know anything about e-commerce in 1997 doesn't mean that the rest of us didn't know anything about e-commerce in 1997. This patent should never have been granted because it fails the obviousness test. Unfortunately, it is exceedingly difficult to get a patent rescinded on this basis.

  13. Re:This isn't federal on Is Videotaping the Police a Felony? · · Score: 1

    However, if you actually read the law (18 Pa. Cons. Stat. 5702-5704, and in particular the definition of "Oral Communication" in 5702, you'll see that there has to be an expectation on the part of the speaker that their conversation cannot be listened in on. So it's illegal to point a parabolic mic into someone's bedroom to record their conversations since they would reasonably expect to be secure from other people recording to their conversation in that situation. The DA is going to have a very difficult time arguing that the police officer believed that a conversation held on the side of a public road with another person in the car was secure against eavesdropping. Now, in this case, the police officer claims that the arrestee was hiding the camera from him. The arrestee claims that he held it up clearly and did not hide it. The video will clearly tell who is telling the truth. If the arrestee is telling the truth, then it is absolutely clear that he was not violating the law and the officer could likely even be sued for false arrest.

    If the officer is telling the truth, the case is a little fuzzier, but the DA would still need to prove beyond a shadow of a doubt that the officer believed that the circumstances made it clear that his conversation was not subject to being recorded. Essentially, they would have to demonstrate that he had a reasonable expectation of privacy. And given that he was on the side of a public road talking into the window of someone else's vehicle with another person present, it would be pretty unlikely that they could convince a judge that there was a reasonable to expect privacy. Unfortunately, we'll probably never find out what the court's decision in the matter is, since that's less newsworthy.

    Keith

  14. Re:Hiding on Memory Tools for Password Management? · · Score: 1

    The best system is one that you can keep in your head.

    Oddly enough, this isn't usually a good quality in an encryption system. What's best is if you can keep the needed secrets in your head, but use a computer to do the math. Computers are good for that. I mean, it was helpful for spies dropped behind enemy during World War II to be able to do the whole thing by themselves, but these days, there are computers all around there's nothing suspicious about using one.

    And frankly, And Password Maker has the following features:

    1. It runs virtually anywhere. If you can't install the happy Firefox plugin, then you can still download the javascript version and run that, no installation required. If you're really trusting, you can even run the version which lives on their web site, although I don't recommend it.
    2. It's stateless. There's no password database to get corrupted. There's no flash drive to forget. As long as you can remember your master password and your settings (you can use the defaults or simply write down your settings on a card in for your wallet if you don't want to have to remember them) then you can generate all your passwords, whether at home, at work, at a computer lab or wherever.
    3. It's secure. Figuring out the password for any one place from any other site's password or figuring out your master password from a site-specific password can only be done by guessing the password or by breaking the cryptography. I should note that it is a good idea to have a longer password when using password maker because there is a possibility of a distributed or inside dictionary attack, but then you only have to remember one password, so that shouldn't be as hard. Take two of your old passwords, put them together, and you're golden.

    So, frankly, I don't see why anyone uses anything else or, for that matter, nothing at all.

    Keith

  15. Why this is a bad decision from a legal standpoint on Mod Chippers Ordered to Pay $9 Million in Fines · · Score: 1

    The law outlaws circumventing measures which protect copyrighted content. These are defined as measures which require the application of information or some other process to render the copyrighted work accessible. For instance, DVDs are scrambled, and the DVD player must have a key to unscramble them. However, video games are not scrambled. They are not encrypted in any fashion. They're just signed. The "copy protection" mechanisms in video game systems do not protect the content. They protect the hardware. They prevent the hardware from running unauthorized code. As such, they cannot, according to the law, be considered to effectively control access to a copyrighted work since the copyrighted work is still on the disk and can be read by an emulator or any other device which wishes to. Mod chips do not therefore violate the DMCA as written. As such, even if the lawsuit was unopposed, the judge should not have awarded damages due to the DMCA. Logically, one of the following occur: 1) the judge failed to understand the law 2) the judge failed to understand the technical issues or 3) Sony committed perjury in explaining how the copy-protection systems work.

    Keith

  16. Re:Cheap/old x86 with Fedora? on A Replacement for the i-Opener? · · Score: 1

    You can actually get dialup for much less than $20 per month. 650 dialup, for instance, sells unlimited nation-wide dial-up for $6.50 per month (hence the name). There are several other services reselling access to UUnet's nation-wide dial-up network for prices around that range. The fact that some people are still paying $20+ for dial-up just means that they have not bothered to shop around. That said, I would certainly agree that DSL for $20 per month is worth buying.

    Keith

  17. Re:the graph has a notable problem on Everyone Still Rumbling About PS3 · · Score: 1
    You're thinking of the price when it became really popular, not the price at release. They dropped the price after about a year. Initially, they price it at $249 for the version with ROB and $200 for the version without. See the Wikipedia entry if you don't believe me.

    Keith

  18. Re:Troubling, indeed on Diebold Threatens Wary Voting Clerk · · Score: 1
    On the other hand - what if Diebold is honest?

    And what if up is down and black is white?

    Keith

  19. Re:No more HDDVD Blu Ray Stories Please on Consumer Problems with Blu-ray and HD-DVD · · Score: 1

    Quadrophonic technology had two forms which died for two completely different reasons.

    1) Quadrophonic vinyl records: Died because they were crap. The problem is that the signals used to provide the distinguishing sound for the rear channels were encoded on the record by moving them up by 17Khz. Because sound is encoded physically in the bumps on the record, this means that the rear channels were encoded in very sharp, narrow hills. As a result, they were worn off very quickly by the needle. It was just more than what the vinyl was intended to handle. I've heard some audiophiles report that their records no longer had audio on the rear channels which differed from the front channels in as few as 5 listenings.

    2) Quadrophonic 8-track and reel-to-reel tapes:
    These were much more straightforward but they were niche market products which came out around a time when their primary formats were already starting to lose some sales. This was compounded by the low quality of players from many manufacturers. Wanting to offset the costs of the additional components needed for quadrophonic sound, they sacrificed quality. When you're trying to win over the hi-fi early-adopter crowd, this is not the way to go.

    Keith

  20. Re:BitTorrent on 20 Network Changing Products · · Score: 1

    Seriously. How can you leave off an application which now accounts for more than half of the traffic on the internet? And that's without even talking about its effects in terms of changing the economics of delivering large files to large quantities of users.

    Keith

  21. Mod Parent Up on Marvel and DC Enforce "Superhero" Trademark · · Score: 1

    The editors really need to check for freshness on this one.

    Keith

  22. Re:Education starts only with opportunity on Gates Mocks MIT's $100 Laptop · · Score: 1
    Computers don't make opportunities. Teachers don't make opportunities. Public funding of projects, businesses and markets doesn't make opportunities. Opportunities come when a given community finds that is can accomplish something that others in a market want.

    And what if the community has no significant natural resources and no education? How are they supposed to create something in the market that others want?

    One of the points of education is to enable them to do just this sort of thing. If they have computers and someone to help them learn, they can certainly become computer programmers, software testers, data analysts, web designers, or any one of a variety of different professions which can be easily outsourced. The internet also provides access to information about science and technology that most rural schools are not providing. The reason that so many people are sustenance farmers rather than commercial farmers is that they aren't even aware of simple techniques like crop rotation.

    Now, mind you, I do agree with the parent's main points that we need to lower trade barriers and combat cornyism and corruption. These are clearly significant barriers to ending poverty, likely more so than a lack of education. But alone they are not enough. There are places without significant cronyism, corruption, and oppression which are still dirt poor (large portions of Mississippi, for instance). Improving education is one of the best ways to improve the economic outlook in such areas. In the end the poor need hope, freedom from oppression, education, and start-up capital. If any one of those is missing, the odds aren't good.

    Keith

  23. Re:not censored on Are Marines Censoring Web Access for Troops in Iraq? · · Score: 1

    I understand that it's not the military's own list of sites. However, this alone does not answer the question of why some of these sites are censored and others not. Clearly there are several feasible explanations:

    1) Coincidence. The lists aren't very good and they just happen to hit some of these sites and not others. This is certainly possible.

    2) Local override. The list blocked all of the sites, but some of the sites were enabled as the result of user complaints. This could mean that there is bias on the part of system administrators or it could mean that liberal users have not complained.

    3) Bias in the lists. Simply because a list comes from a company does not mean that is necessarily an objective list. In the past censorware companies have done things like block web sites which were critical of censorware. It could be that there is political bias in the lists. Obviously, this would not be the military's fault.

    What we need to figure out which of these three cases applies is more evidence.

    Keith

  24. Re:not censored on Are Marines Censoring Web Access for Troops in Iraq? · · Score: 1
    No, I'm simply asking the question why some of these sites are blocked and others not. All I'm looking for is to know whether or not political bias exists. As I said in my previous post, there is an appearance of political bias in this very small sample set. Whether ot not their is actual bias is the question. It may be that the blocking of sites does not have anything to do with politics, but the question deserves to be examined.

    You've made it very clear in your posts that you do not believe that bias exists, but that is not evidence one way or the other. If you don't have any evidence to add, please don't go slinging around accusations about other people's motives as that sort of attack is both immaterial and impolite.

    Keith

  25. Re:not censored on Are Marines Censoring Web Access for Troops in Iraq? · · Score: 1

    So really, the scandal here isn't what they're blocking, but what they aren't blocking. From what you say that they a very legitimate reason for blocking AirAmerica. However, that same reason clearly applied to www.rushlimbaugh.com and www.billoreilly.com which each have streaming audio and video available, but those sites are not blocked. So the obvious question is why aren't they? There's still a clear inconsistency in which sites are blocked and which aren't which at least gives the appearance of splitting on political lines.

    Keith