Slashdot Mirror


User: raymorris

raymorris's activity in the archive.

Stories
0
Comments
10,114
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 10,114

  1. Re:Defective product. Declared secure, illusion of on Google Chrome Wants To Block Some HTTP File Downloads (zdnet.com) · · Score: 1

    The purpose of the cert is for the browser to know whether they are talking to your server, or to my MITM proxy which I made on a Raspberry Pi, ans presents itself as a WiFi network "Convention Guest WiFi".

    If you don't tell the browser WHICH cert you've rolled, it's unable to distinguish your cert from my imposter cert, and therefore you have almost zero security.

    > you suggest the common user can tell the difference between a cardboard box and a safe. They can't (thus the green locks and such)

    I suspect users can see a green lock and have some idea what it means.

  2. "Probably", at the very lowest end of the scale on Senators Introduce Bill That Would Ban Websites From Using Manipulative Consent Forms (vice.com) · · Score: 1

    The article you linked, titled "It Turns Out Spending More Probably Does Improve Education", concludes that the very poorest, least-funded districts saw improvement when their funding was increased to "adequate".

    Which is a lot like the correlation between eating and riding a bicycle - people who are starving to death don't do much pleasure riding. That in no way suggests that if the average American ate more, they'd bike more.

    That's the conclusion of an article cherry-picked to argue for once again increasing spending even more.

  3. Defective product. Declared secure, illusion of se on Google Chrome Wants To Block Some HTTP File Downloads (zdnet.com) · · Score: 2

    If you had a physical safe, 2,000 pounds, which would open whenever someone tapped it on the left side, that would be a defective product. Since you probably bought the safe to protect valuables, you'd want to know if it doesn't offer any security. A security warning about that safe would be warranted.

    A cardboard box would not be defective of it could be opened easily. You don't store gold in a cardboard box and expect high security.

    By applying TLS, the site operators are essentially declaring that the content needs to be protected and claiming that it is protected. If it's not actually protected as claimed, users may want to know about that.

  4. Ask ten people what TLS is on Google Chrome Wants To Block Some HTTP File Downloads (zdnet.com) · · Score: 1, Insightful

    Yeah, if you ask 10 random people what TLS is, you'll find out why Google security engineers think that they know security better than thr average consumer does. It's their. JOB to know security, so they SHOULD be much better informed than the average user. They shouldn't forget that fact when they make *defaults* and *warnings*.

    On the other hand, I've been an internet security professional for twenty years. I can reasonably decide to override the defaults in selected situations. I am not a typical user in that regard.

  5. I should have said "an authority" rather than "government".
    From Oxford Dictionary:

    censor
    NOUN
    An official who examines books, films, news, etc. that are about to be published and suppresses any parts that are considered obscene, politically unacceptable, or a threat to security.

    There are two key parts of the definition, a part that is there and a part that is NOT there. The definition does not mention the word "bad". Something can be bad and not be censorship. Something can violate free speech and not be censorship. Censors is one of many methods of infringing on free speech, generally the most extreme method. So if I say something is not censorship, that doesn't mean I think it's good. It might be bad, and not have any censors involved.

    The key part of the definition that IS there is " examines books, films, news, etc. that are about to be published". Censorship prevents the public from ever seeing the material at all. That distinguishing it from systems in which the material is available to the public, and later the public can judge whether any charges brought against the publisher are just.

  6. Or study and vote yourself on Senators Introduce Bill That Would Ban Websites From Using Manipulative Consent Forms (vice.com) · · Score: 1

    Of course if you DO want to study the issues and the candidates' positions, you could step up as a rep voter yourself. Just find four friends to choose you as their designated representative.

  7. Or just know which friends are dumb, smart on Senators Introduce Bill That Would Ban Websites From Using Manipulative Consent Forms (vice.com) · · Score: 1

    With the current electoral college system, one doesn't know either the electors or the candidates, so you have to study.

    Thinking of people I know personally, I can think of three or four people who have shown some wisdom in how they lead their life. I see that they make solid decisions, very reasonable decisions, which are sometimes different than the decisions I made. Suppose I care evenly about social policy and tax policy. I could reasonably say "my friend from church who built her accounting practice from the ground up into a successful business with five employees is a smart lady. I don't know the details of the different tax proposals, but I can trust that when she says she has studied them, she'll draw reasonable conclusions. On social issues, I know we and I are coming from the same general mindset. I trust she'll choose candidates with positions that are reasonably compatible with our shared world view".

    The point being, I DON'T have to study tax policy if I can vote for a friend who does study tax policy, and who makes good choices. Heck, even if 20% of adults were chosen as electors, that would leave you with roughly the following choices among five people you know:

    Your high school drop out brother who bags groceries and dreams of being an actor

    You brother-in-law, the tax lawyer

    Your 50% senior mother

    The crackhead staying on your couch

    Your sister, who is working on her masters in social work

    Two of these choices are obviously better than the other three, to put in charge of studying the candidates. Either choice significantly improves the average voter knowledge compared to having all five vote directly. Crackhead can vote for tax lawyer knowing ONLY that the tax lawyer isn't likely to make choices much worse than the choices crackhead tends to make.

  8. Highest funding, lowest results on Senators Introduce Bill That Would Ban Websites From Using Manipulative Consent Forms (vice.com) · · Score: 1

    The US has among the highest education spending in the world, and among the worst results in the developed world. As our spending has increased, results have gotten worse.

    I'm fortunate to live in a school district that is very much not "one size fits all". Embracing "different strokes for different folks", we have several different types of magnet schools to choose from, charter schools, and traditional schools. Many the schools are rated 10 or 9 (of 10) on GreatSchools.org.

  9. On the other hand, do you want to stay tiny? on Udacity Restructures Operations, Lays Off 20 Percent of Its Workforce (techcrunch.com) · · Score: 3, Interesting

    Your comment sounds like something I would have written ten years ago. What you say is true. There is also the other side of the same coin.

    I've started a few businesses. One in particular had a product well ahead its time, the best product in a billion dollar market. The product technology was five years ahead of the competition. My modus operandi was always to grow organically without debt, re-investing profit. I also offered a very good value price point, meaning there was little money for marketing or growth.
    Other companies who took on a little debt were able to catch up on technology, while getting far more market share. Those companies dominate that market, earning many times the debt, while my company slowly withered away. Being slow to grow cost me literally millions of dollars. Higher prices and a little debt probably would have been a very good idea.

    If I start another company* I may very well focus more on growth, including taking on a little debt -after- proving the business model. I'm very wary of personal debt, but it was probably a mistake to not take out debt equal to the previous three months profit, at least, as long as the company continued to grow.

    Again not disagreeing with you, just saying that while a lot of debt can be bad for a business, so can no debt, in a new market or a growing company. Next time I'll save "no debt" for my personal finances.

    * I'm thinking here about starting a -company- as opposed to "owning my job". When I retire I might have an LLC or S-corp through which I offer consulting services or something, where the "company" is me. In that case I wouldn't do debt. If I intend to build a company with 50 or more employees, some debt or equity financing is probably a good idea in order to go from nothing to a company in a reasonable time. I won't have another company with two employees - it's not worth the legal and tax hassles of being an "employer" unless you have five or more employees.

  10. "who is the Vice President" eliminates half on Senators Introduce Bill That Would Ban Websites From Using Manipulative Consent Forms (vice.com) · · Score: 3, Interesting

    Approximately 50% of American adults don't know who the Vice President is.

    Yet some say it's super important that everyone come out and vote for your Senator. Because they all know which fiscal policy proposals supported by each Senate candidate will be more effective in the long run, and in the short run?

    For a lot of people, public policy, economics, and international relations are not on their top 10 list of interests. They don't care to spend their time learning about any of that. I'm not so sure our state or country is so much better off because they vote (based on a Tweet their friend told them about, or "he's good looking").

    Maybe, just maybe - we should encourage people to learn about civics so they can be informed voters. If they decided they don't want to know the difference between microeconomics and macroeconomics, if they don't care who the incumbent is, if they don't know what their current tax rate is, maybe it's okay if they leave the voting to people who do have some basis for making a rational decision of who to vote for.

    Actually, expanding that idea might make for a good system. I've had multiple friends put me in the awkward position of asking me who they should vote for, because I'm a nerd who likes to study this stuff. I don't feel right answering the question of who they should vote for, but I kinda don't feel right leaving their questions unanswered. So here's an idea:

    I bet most people know someone who knows who the Vice President is. They probably have one friend who knows their current tax rate. They could vote for the person that they know. You vote for whichever of your friends you think is most informed or would vote smart. Maybe one every ten or twenty adults gets voted in by their friends. Then it is their responsibility to study the candidates and the the issues and vote for the actual office holder. That way everyone gets a say, and the people directly voting for a senator or president actually know what the candidate's policy proposals are.

  11. That was funny

  12. That word doesn't mean what you think it means on Senators Introduce Bill That Would Ban Websites From Using Manipulative Consent Forms (vice.com) · · Score: 1

    It sounds like you care about freedom of speech. You want too avoid regulation of speech. That's cool.

    In order to make a convincing argument regarding restrictions in speech, you might want to learn the basic vocabulary of the topic. Things like:

    A. The first amendment prohibits the federal government from infringing freedom of speech. (You might know that already.)

    B. A censor is someone who redacts portions of a work before it can be seen by the public.

    C. Censorship is a system of - censors. Government officials who have to approve speech before it can be published.

    Censorship is one method of implementing or enforcing severe restrictions on speech. Other methods include fines and jail time.

  13. You may be mixing different things on Congress is About To Ban the Government From Offering Free Online Tax Filing (propublica.org) · · Score: 3, Insightful

    Article 1 section 8 says:

    The Congress shall have Power To lay and collect Taxes, Duties, Imposts and Excises, to pay the Debts and provide for the common Defence and general Welfare of the United States; but all Duties, Imposts and Excises shall be uniform throughout the United States;

    Duties, imposts, an excises are taxes on transactions, on doing things, as opposed to a tax on being (either a tax on a person being alive or a thing existing). A sales tax is an excise tax. The requirement, then, is that the tax is uniform - the feds can't set a different rate in California than Florida. Note there is no mention of census or population. So no Constitutional issue with a national sales tax.

    So where DO we find a mention of population?
    We find that regarding "direct taxes", which are taxes on being (either a person, being a alive, or a tax on a thing based on what kind of thing it is - a tax being a car or being a house). This as opposed to taxes on transactions, on doing. Direct taxes therefore are:
    Real Property taxes
    Capitation ($x per person)
    Personal property taxes
    See
    Murphy v. Internal Revenue Service and United States, case no. 05-5139,

    For these direct taxes only, the Constitution provides that:

    --
    Representatives and direct taxes shall be apportioned among the several States which may be included within this Union, according to their respective Numbers.

    So the feds can't tax each of the states $1 billion for property, direct taxes (taxes on people or property) have to be apportioned by population.

    What does "apportioned" mean? Well, we're talking about taxes here, not spending. Apportioning TAXES means how taxes are levied amongst the states. As mentioned previously, this applies only to direct taxes, so it has no relevance for transaction taxes anyway.

  14. x86 originally 16-bit on Internet RFC Series Turn 50 (circleid.com) · · Score: 1

    x86 assembly was originally written for a 16-bit CPU.
    "16-bit CPU" means a CPU with 16-bit words.

    When Intel introduced "32-bit processors" (CPUs with 32-bit words), they found that some programmers had defined things to be "word" when what they actually needed was 16 bits. Updating the setting of word would make a lot of software faster (where the value should actually be hardware word), but would break software that used word values incorrectly (assuming it would always be two bytes). Intel chose backward compatibility, not breaking software that had incorrectly assumed a word would always be two bytes.

    It's like assuming that a size_t is the same size as an int. Sometimes it is, today. Sometimes it's not. Intel catered to those who made the error.

  15. Where do you stay those defined? on Internet RFC Series Turn 50 (circleid.com) · · Score: 1

    > For example, the word "conversation" in the RFC doesn't refer to two people chatting about the weather, does it?
    > Or how about "bit"? It wasn't a drill bit, or a bit of money, or a bit part in a movie, was it?
    > So according to your rules, they should have been capitalized.

    Where, exactly, do you see "bit" and "conversation" defined in that RFC, or any contemporary RFC?

    I didn't say "all caps means a technical term".
    All caps means a term defined in:
    1. That RFC or
    2. An RFC which is referenced

    For example, most RFCs reference RFC 2119, which defines SHOULD, MUST, and MAY
    http://www6.ietf.org/rfc/rfc21...

    So yeah those should not be capitalized per best practice, because there isn't a specific definition included which is being referenced.

    Since that's the very first RFC, fifty years old, and usage RFCs like 2119 hadn't been written yet, you probably *can* find some instances where the very first RFC did not comport to modern guidelines fifty years later. Neither bit nor conversation are examples, though.

    Indeed, BIT probably *is* defined in a special way for some physical interface standards, such as 100base-tx, which defines a HIGH bit as being over a certain voltage, and a LOW being below another voltage, with an undefined error band in the middle. Capitalizing BIT would have indicated that one needed to refer to a given specialized definition.

  16. In RFCs, all caps means a special, defined term. on Internet RFC Series Turn 50 (circleid.com) · · Score: 4, Informative

    > It's just a WORD like any other, it's not an acronym.

    You almost figured out why. In an RFC, putting a word in all caps means it's NOT "just a word like any other", the dictionary definition does NOT apply. All caps means "this term is being used to mean something specific which is defined elsewhere in an RFC".

    For example, you said:

    Why would a WORD like host need to be capitalized?

    In an RFC, "a word" means what it means anywhere else. "Cow" and "print" are words.

    However, "a WORD" might mean a data item with the same number of bits as the machine's data bus. On a 32-bit machine, a WORD is 32 bits.

    In a RFC about a text-based protocol, a WORD might be defined as "a sequence of one or more printable non-whitespace UTF characters". In which case "printk" would be a WORD, as would "starttls".

    All caps means "we have a specific definition for this term, and we're using the term in that specific sense here".

    Perhaps the most frequently used all-caps terms in RFCs are SHOULD, MUST, and MAY. Specifically, MAY and may need to be disambiguated. "May have security vulnerabilities" means vulnerabilities might exist. "MAY have security vulnerabilities" means it's ALLOWED to be vulnerable - it's specifically okay to do anything marked MAY. (In this instance perhaps any security weaknesses in that part of the algorithm don't matter because it's taken care of when the chunk is encrypted at a higher level).

  17. Non-students actually have to eat on 14-Year-Old Earned $200,000 Playing Fortnite on YouTube (dailyherald.com) · · Score: 1

    I gave some surprising news for you. If you're not studying, you still need to eat, have a place to live, etc. So counting the cost of food, housing, etc as the cost of school is ... well that's just stupid.

    Just for fun, just because you want to, let's play the stupid game. Let's pretend that the cost of rent, food etc, is the cost of school. You're paying those things today. If you're paying "the cost of school" and not collecting your degree, that would be pretty stupid, wouldn't it?

    So as soon as you go down that road you have your choice of two kinds of moronic.

    >. Oh, and the online course mean shit.

    Personally, I *like* having an annual salary equal to the cost of a 2,000 square foot house. (Meaning I could buy house every year with cash if I didn't have other expenses.) I being able to go to Disneyland and Jamaica with my kid, having a salary that can afford those things. It may not mean anything to you, but I like it.

    Given that I was going to get a master's from a top 5 ranked school (top 3 in my field), I didn't have any need for a brand name on my bachelor's. Net cost after tax credit for my bachelor's was $13,500 from WGU. After graduating WGU and before starting my masters my salary was well into six digits. Of course I picked a field that's in demand, not TSTV history.

  18. A very big if. Also inflation - needs a million on 14-Year-Old Earned $200,000 Playing Fortnite on YouTube (dailyherald.com) · · Score: 1

    > If he can get $500,000 in earnings invested conservatively and not touch it for ten years

    After taxes. That's a very big if. He's hot this year. Great. We'll see about next year. Also you need to account for inflation - you need about a million bucks to be financially independent, living comfortably off the earnings. A LOT of people slowly save up a million - it's simple and most anyone in tech can do it, it's not at all easy.

    Investing is a VERY good idea. Very, very good. And one of the very best investments you can make is a WISE choice of school, like investing a total of $5,100 to get a master's degree from one of the best engineering schools in the country:
    https://slashdot.org/comments....

  19. $19K. A top 5 engineering school on 14-Year-Old Earned $200,000 Playing Fortnite on YouTube (dailyherald.com) · · Score: 4, Insightful

    > Yes but how much would that cost now?

    US News and World Report does probably the best-known ratings of universities. Here are the ratings for engineering programs at Georgia Tech:

    #2 in Aerospace /Aeronautical / Astronautical

    #3 in Biomedical

    #2 in Chemical

    #2 in Civil

    #5 in Computer

    #4 in Electrical / Electronic / Communications

    #4 in Environmental / Environmental Health

    For out-of-state students, the tuition for a Georgia Tech master's degree which he can do online (he'd probably like that) is $5,100. Here's the master's in computer science, as one example:
    https://www.omscs.gatech.edu/p...

    You CAN pay $12 for a cup of coffee, or $1. You can pay $21 for a Sekai-ichi apple, or take your pick of many delicious apples for 25 cents at your nearest grocery store. College is the same - if you totally ignore costs, spend like money is meaningless, you can radically overpay. You can spend $70K on an advanced degree in women's studies or Inuit history. Or you can spend your money like - it's your money. Shop for a good value.

    In my case, I (recently) did a bachelor's degree program in which many of the courses were tied to industry certifications. For example, for a networking course the final exam was the Cisco CCNA. Because of that, half way through school I had already achieved multiple respected certifications, which doubled my income even before I finished my degree. I graduated with more money in the bank than I had when I started - the exact opposite of piling up student loan debt.

    There are car dealers who will gladly charge you $30K for the same car you can buy elsewhere for $8K. Universities are no different.

  20. That'll pay for a master's degree or whatever on 14-Year-Old Earned $200,000 Playing Fortnite on YouTube (dailyherald.com) · · Score: 1

    That's awesome the kid is making some good money this year.
    It sounds like his parents may be foolishly thinking it's going to last forever.

    My bachelor's and master's degrees, in a field I really enjoy, will cost me a total of about $19,000 and form the foundation of a very solid income for life. This kid can easily afford to set himself up in a solid career that he'll enjoy. If his parents aren't stupid and think a video game is going to be his permanent job forever.

  21. Re:True. I started to mention that on Apache Web Server Bug Grants Root Access On Shared Hosting Environments (zdnet.com) · · Score: 1

    Very cool, thanks for explaining that. Makes sense. Doing it as an exception was clever.

    > This was actually my first time using an ARM processor, and they didn't really have tools widely available for working with them. I did my reverse engineering, as well as my modifications to the unprotected exploit bootloader with the actual ARM docs.

    You're not easily intimidated are you? :)

  22. Obviously time for me to sleep on Apache Web Server Bug Grants Root Access On Shared Hosting Environments (zdnet.com) · · Score: 1

    As I was drifting off to sleep I wrote:

    > Not emulated, we know what Cygwin stands for.

    As I was writing "Cygwin", half my brain was apparently thinking "Wine". *Wine* is not an an emulator. Lol.

  23. Re:True. I started to mention that on Apache Web Server Bug Grants Root Access On Shared Hosting Environments (zdnet.com) · · Score: 1

    > several jailbreaks of the early iPhones ... The first person to ever break the firmware RSA signature protection on a cell phone (V3 RAZR)

    That's very cool. I've worked in security for many years, and I have a pretty good understanding of cryptography, but always from a defensive standpoint. I very, very rarely break anything. Do you happen to have a write up of how you want about doing that, in a practical sense?

    Over 90% of my time thinking about how people might break things is theoretical, what one theoretically could do. How you'd actually break that RSA signature would be very interesting to me.

    > I was thinking more along the lines of WSL/Cygwin/POSIX Subsystem for Windows.
    The fact that (near) POSIX compliance is offered by Cygwin's libraries doesn't make it emulated

    Not emulated, we know what Cygwin stands for. If someone says "native Windows APIs", they probably aren't talking about Cygwin. :) So neither emulated not native to that system.

  24. Re:True. I started to mention that on Apache Web Server Bug Grants Root Access On Shared Hosting Environments (zdnet.com) · · Score: 1

    I don't know enough about the topic to say much more intelligently. My name is in the kernel changelog only once.

    I do notice that all Lamborghini Countach kit cars are built on Fieros, none are built on on VW bus, or a Corolla. As you said, it's much easier when the source is like the target in basic structure.

    As to native, I suppose it also depends to some extent on the native source environment. If you had a true micro-kernel, perhaps in an academic setting, putting a lot of functionality in libraries would be "native", it would be the standard way to do things on that platform. On the other hand, if you were starting with a monolithic system with no networking, no concept of sockets, any userspace implementation of pselect would probably be quite foreign.

  25. Editors are responsible for their decisions. Phone on Facebook, Google, Twitter To Face US Lawmakers About Tech 'Censorship' (cnet.com) · · Score: 3, Informative

    The following is current US law.

    The phone company is not responsible for the content of any phone call, because they don't control the content of the communication. They don't even know what you're saying on the phone, so they aren't responsible for what you say using their phone network. That probably makes sense intuitively. This is long-standing law.

    If a magazine, such as US News and World Report, publishes libelous articles falsely accusing you of all kinds of things, with reckless disregard for the truth, they are responsible. You can sue them. Their writer and editor decided to publish those lies about you. This is also long-standing law.

    In essence, if they control what is said, they become responsible for their decisions. The term is "editorial control".

    Wise management of a platform, therefore, has been to refrain from editorial control. Don't decide what gets posted - or you will be responsible for what you decided to publish. Slashdot found a good way to do that. Nobody at Slashdot decides to remove "bad" posts. Rather, the readers decide how prominent a post should be. Slashdot gets the benefits of moderation (crap tends to become invisible fairly quickly) without the legal liability of Slashdot picking and choosing.

    > How , if they become a publisher, do they become liable for an opinion piece any more so than a newspaper?

    A newspaper is liable (responsible) for what they publish. Their editors decide what to publish and not publish. Because of freedom of the press protected by the first amendment, they are allowed to say pretty much anything that is either true or purely opinion. Libel will get them in trouble, and certain other things that aren't protected.

    Practical effects were that widely-distributed communications (broadcast) were controlled by media companies, which were responsible for their content; person-to-person communications such as phone calls and letters were only carried, not controlled, by large companies. Individuals were responsible for what they wrote, but they could only write to a few people at a time.

    Speaking of freedom of the press, for about thirty-five years there has been a push from the big government party to force publishers to publish whatever the Congressionally appointed bureacracy at the moment thinks is "fair". Relevant search terms include "fairness doctrine" and "equal time". Basically Reagan was good on television (he was a movie star), and the opposing party was trying to legistlate themselves more air time. The courts and the "limited government" party have pushed back on this, of course.

    More recently, as the web has become more popular, we've had more and more instances of individual speakers reaching large audiences, such as popular blogs, Twitter accounts, and YouTube channels. That means that an individual can reach a large audience. The company simply carries the communication, without editorial control. No longer do you have to be a large media company in order to have a sizeable audience.

    With that change, the long-standing separation between carriers and publishers (authors) has led to some uncomfortable situations. Does Facebook really have no responsibility for what is posted there? Well, is the postal service responsible for what is sent through the mail?

    With the new ability for individual speakers to reach significant audiences, compromise is sometimes used. Remember the phone company or the USPS isn't liable in part because they don't even know whether the content of the communication is lawful or not. In some cases, once the platform has been NOTIFIED of unlawful content, they can then follow a specified procedure to protect themselves from liability.

    One example of a specified procedure is a procedure available in instances of a claim of copyright violation. The copyright holder notifies the platform that they are hosting infringing material. The person who posted it can then notify the platform that they disagree, they say it's NOT infringing. If person w