Slashdot Mirror


User: Kiwikwi

Kiwikwi's activity in the archive.

Stories
0
Comments
195
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 195

  1. Re:"could be worse than Heartbleed" on Flurry of Scans Hint That Bash Vulnerability Could Already Be In the Wild · · Score: 5, Informative

    Outside of malicious HTTP headers landing in environment variable in CGI land, I'm hard pressed to think of another reasonable vector for this bug to be a problem...

    Unfortunately, attackers do not share your lack of imagination.

    First of all, the CGI vulnerability is not about CGI scripts written in Bash, this is about any CGI script that at any point invokes a shell or invokes a program that invokes a shell (e.g. using the system call), irrespective of the actual shell command, on a system that uses Bash as the system shell (so pretty much all non-Debian based Linux distros).

    Got that? any CGI program + any non-Debian Linux => vulnerable. (For once, the PHP programmers are ahead security wise due to the ubiquity of mod_php...)

    Second of all, there are all kinds of non-CGI situations in which untrusted data is passed in environment variables. This is normally not a problem... unless that environment variable at any point is inherited by Bash.

    The ISC DHCP client (dhclient) is the canonical example, as it runs a distro-specific shell script to set up the network once it gets a DHCP lease. Unustrusted values from the DHCP server are passed - you guessed it - in environment variables.

  2. Oblig. on How Our Botched Understanding of "Science" Ruins Everything · · Score: 1
  3. Re:In lost the will to live ... on How Our Botched Understanding of "Science" Ruins Everything · · Score: 2

    Why is causing pain to others bad? Why do you care about what other people feel?

    Quid pro quo. I care about them and don't cause them pain; and in return, they care about me and don't cause me pain. It's also called the social contract.

    You may argue, "prisoner's dilemma" style, that an individual can then gain an advantage by breaking the social contract, and indeed some people do that. Bruce Schneier wrote a whole book about that topic. But as it turns out, most people don't break the social contract, due to 1) intense social conditioning (religious or otherwise) and/or 2) the threat of punishment if they're caught.

    The social contract predates Christianity by millenias; heck, it presumably existed in a primitive form in stone age hunter-gatherer culture.

    But even ignoring social conditioning and even the evolutionary traits that have developed to promote that contract (e.g. increased empathy), abiding by the contract still makes sense: Civilization depends on the majority following the social contract, and indeed, most people find that the immediate benefit of breaking the contract is outweighed by the threat of civilization falling apart. Of course, once people start to break the social contract in larger numbers, the cost-benefit ratio changes, and civilization crumbles quickly.

    Surely you've heard of the Golden Rule? This requires zero belief in the supernatural or any sort of sacredness.

    Except that it doesn't explain why you should follow it. Most people seem to use "karma" (or "what comes around goes around") as a not-quite-as-supernatural-as-an-omnipotent-God reason for following the Golden Rule.

    I'd argue that karma is a real thing, only global, not personal. When you do a good thing for others, you increase global karma, ever so slightly increasing the odds of good things happening to you, too. (But it's a big world; I think you'll find playing the lottery has better ROI.)

    Personal karma AKA the "just world" belief is of course a myth. The fact that so many people believe in it is a testament to the aforementioned social conditioning.

  4. Re:Parallax. on Apple Edits iPhone 6's Protruding Camera Out of Official Photos · · Score: 1

    Yes they have. Two of my coworkers have them now. Got them a few days ago. That's the result of big money contracts.

    I mistakingly read this as a response to linear a's post above:

    Another Lie! Slashdotters don't have "fiances".

  5. Re:Don't google it. Bing it! on Court Rules the "Google" Trademark Isn't Generic · · Score: 1

    I'm sorry, but saying you "binged" it sounds slightly obscene...

    Could be worse. Microsoft originally considered calling it "Bang".

    ...

    I'm not kidding. I guess they liked "Bang" because it conveyed a sense of, uh, instant gratification. Specifically:

    The company had several criteria in rebranding the search engine, he said. The company wanted a name that was one syllable and couldn't be misspelled and was as short as possible.

    Webster said he initially came up with "Bang." The name had a few things going for it, he noted. "It's there, it's an exclamation point," he said. "It's the opposite of a question mark."

  6. Re:Simple change. What about round abouts on Surprising Result of NYC Bike Lanes: Faster Traffic for Cars · · Score: 1

    Huh? Roundabouts and standard crossings are equivalent when it comes to pedestrians. In both cases, you add crosswalks "circling" the roundabout or intersection, and cars must yield for pedestrians when entering and leaving the roundabout/intersection. (Example of small roundabout with pedestrian crossings and bike path.)

    If there's a lot of traffic, you add traffic lights; this, too, can be done for both roundabouts and intersections. (Example of roundabout with traffic lights; though I've personally observed that it's able to carry traffic pretty smoothly even when the lights are malfunctioning. This latter example also has heavy segregation between cars and bicycles; research has shown that cars are unfortunately slighly more likely to overlook bicyclists otherwise, compared to a standard intersection.)

    Of course, there's always hideous designs like the Dupont Circle mentioned above, but that's just traffic planners showing that they don't understand roundabouts. Pedestrians should walk around the roundabout, not across it (hence the name), otherwise cars have to yield for pedestrians inside the roundabout, and you get a complete traffic jam. (The whole point of a roundabout is to limit the number of directions in which traffic moves...)

  7. Re:I assume she's not qualified because she's a wo on White House Names Google's Megan Smith As CTO · · Score: 1

    I have no problem giving the job to the most qualified person, even if that person is a woman. But she's not the most qualified person! You know how I know? Because she's a woman! She is clearly an AFFIRMATIVE ACTION pick. She's no good. All she knows about is mechanical engineering (aside from her years of IT experience)! I'm so sick of all this AFFIRMATIVE ACTION! Again, I'd love to give the job to a qualified woman. But every woman who gets any job gets it because of AFFIRMATIVE ACTION!

    Thank you for this succinct recap of much of this Slashdot discussion thread.

    You did forget to mention how the position was "just invented" for her. (And her two predecessors, err...)

  8. Re:Driverless on California DMV Told Google Cars Still Need Steering Wheels · · Score: 1

    In the Copenhagen Metro (driverless), there are emergency brake levers next to every door. However, it was considered dangerous for the train to stop in a tunnel (and have passengers exit through the tunnel). Therefore: If you pull the emergency brake, the train will continue to the next station, then stop. (If you don't pull the emergency brake, the train will continue to the next station, then stop...)

    Anyway, this might still be the safest mode of operation. If there's anything rail automation has taught us over the last century, it is this: Whenever the human second-guesses the automation, odds are that the human is wrong. About time cars got to this point, too.

  9. Re:Watermarks? on GOG Introduces DRM-Free Movie Store · · Score: 1

    Watermarks are pointless in this context. Watermarks are used to annoy pirates and nail leaky insiders, thats about it. Its an extremely limited tactic.

    Exactly. Watermarks are useless against general piracy, since the burden of proof is simply too high to take the case against John Q. Public.

    For instance, most people don't know that when you buy music on iTunes, Apple puts your e-mail-address in a metadata comment field in the file. But now that you do know, feel free to take a look at The Pirate Bay and start collecting e-mail addresses from AAC files.

    Note that it's not a watermark - it's not in the audio data, it's plainly visible in the file and it's trivially removed. Yet the pirates don't even do that. And why should they? I've never heard of a person being even threatened with legal action over this.

  10. Re:Why not some really old movies on GOG Introduces DRM-Free Movie Store · · Score: 4, Insightful

    There are more recent films that also lapsed into the public domain, due to a failure to register the copyright, "Night of the Living Dead" being perhaps the most well-known example.

    The real reason why GOG doesn't include these films is three-fold:

    1) There are already sites doing this (for free), e.g. the Internet Archive.

    2) The quality of the original prints is often poor, restoring old movies requires great skill and is very expensive, and existing restorations are not public domain.

    3) Most importantly, it's besides the point. GOG is trying to get the film industry to recognize the value of selling DRM-free movies, like the music industry did before them. Selling public domain movies would be plain counter-productive.

    Here's hoping they'll succeed where others have failed before them.

  11. Re:Oh darn I forgot to ask... on Interviews: Bjarne Stroustrup Answers Your Questions · · Score: 1

    ...how the hell you say that guy's name.

    Roughly "B-yarn-uh Straw-strop".

  12. the war on drugs is precisely why the US has imprisoned a far higher percentage of its population than any other first world nation.

    To be specific, the US incarcerates more people than any nation, first-world or not. That's not only by percentages, but also by absolute numbers. Roughly one in four prisoners worldwide sits in a US prison.

  13. Re:How is CO2 leading cause of warming? on NASA's Greenhouse Gas Observatory Captures 'First Light' · · Score: 1

    Of course they have but the point is that CO2 emissions have been constantly high over that period, which should have accelerated the trend line upward way more than it has.

    The NOAA source I linked can tell us that the 1990-2014 trend has been a rise of 0.14 C per decade, and that 2013 was already 0.78 C above the 1880 pre-industrial level. A simple linear extrapolation gives us a temperature of (2100-2014)*0.014 + 0.62 - (-0.16) = 2.0 C in the year 2100, coincidentally the same 2 C used as the critical limit beyond which global warming will have alarming consequences.

    Some may contend that the 2000-2014 trend has been a rise of only 0.04 C per decade, to which I'll note that the 2012-2013 trend was a rise of 0.47 C per decade. Unsurprisingly, short periods make for bad statistics. But when you pick a longer period - whether you go back to 1990, 1980, 1970 or even 1960 - you consistently get ~ 0.14 C per decade.

    (Please substitute "degrees celsius" for C above, since Slashdot apparently supports neither Unicode nor even Latin 1...)

  14. Re:How is CO2 leading cause of warming? on NASA's Greenhouse Gas Observatory Captures 'First Light' · · Score: 2

    actual warming has kind of flatlined,

    I keep hearing this, but I really don't see it.

    It's like the repeated statement that "there has been no warming [since the record-setting global average in 1998]". Nobody ever claimed that global temperature would rise monotonically year-on-year; fortunately, we are allowed to look at the trend line across years and draw the quite obvious conclusion that yes, temperatures have been rising in the last two decades as well.

    (You'd think the 1998 argument would lose steam after the 2005 and 2010 global temperature anomalies actually surpassed the 1998 record, but I guess it was never an argument made in good faith.)

  15. Re:Why is on Netflix Now Works On Linux With HTML5 DRM Video Support In Chrome · · Score: 1

    That begs the question, [...]

    I see what you did there. Let's take it one at a time, thanks. ;-)

  16. Re:same thing again on Amazon's eBook Math · · Score: 1

    Something rubbed me the wrong way, I think it was your false argument that there is no benefit in stating the obvious.

    Hm, my fault then; I really was aiming for "+5 insightful", not "-1 rub the wrong way". :-)

    There is a benefit to stating the obvious, it's just not a very big one. The problem with the Laffer curve is that it really just states two things: 1) At 0% taxation, there will be no tax revenue, and 2) At 100% taxation, there will be no tax revenue. And as mentioned, the latter of those two postulates, while "obvious", is also demonstrably false. This leaves postulate 1, which I can't disagree with, but which is also completely useless.

  17. Re:same thing again on Amazon's eBook Math · · Score: 1

    Amazon's pricing argument is one instance of the same general phenomenon that gross expenditures, under some conditions, increase in response to price decreases. The effect has different names in different contexts:

    With taxation, people sometimes refer to the Laffer Curve, which for levels of taxation to the right of the peak of the curve, reducing tax rates increases tax revenues.

    For technology, Jevons Paradox explains why, as the efficiency of home appliances increases, so does energy consumption.

    This is off-topic, but you brought up the Laffer curve and Jevons paradox, so here comes the rant.

    Both make for some nice economic theory, and like much economic theory, it's mostly speculation.

    The Laffer curve, for instance, is a nice "sciency" sounding name for the idea that at a 100% tax rate, there will be no tax income, since nobody will be doing any work if they have to pay all their income in taxes (thus the "optimal" tax rate must be somewhere between 0 and 100%, both excluded). Not only does the entire Laffer curve theory just state the "obvious" (it brings no insights as to what the optimal tax rate might be), but the premise is also demonstrably false, since people will actually do some work for free (but of course, volunteer work doesn't exist in mainstream economics; it's like wind resistance in introductory physics, you just ignore it).

    Jevons paradox is the same; to quote the very article you linked to:

    [...] Saunders dubbed the hypothesis that improvements in energy efficiency work to increase, rather than decrease, energy consumption the Khazzoom–Brookes postulate [a specific instance of the Jevons paradox]. Saunders showed that the Khazzoom–Brookes postulate was consistent with neo-classical growth theory (the mainstream economic theory of capital accumulation, technological progress and long-run economic growth) under a wide range of assumptions.

    That's mainstream economic theory. Meanwhile, in the real world, using real observations, economists found that there was only a small rebound effect, and that energy efficiency improvements actually does decrease energy consumption. (But since reality conflicts with the theory, we'll just ignore reality.)

    To get back on topic, I'm not saying all economic theory is bullshit (but there's lies, damn lies, and economics...), just that when people trot out economics, there's usually an agenda, and the invocation of economics is often part of an "appeal to authority" fallacy. (Like how the Laffer curve is inevitably brought up as an argument for reducing taxes, ignoring the fact that estimates of the "optimal" tax rate cluster around 70%(!), above even the highest income tax rates found anywhere in the world.)

    Amazon is of course not above manipulating numbers for its own benefit; the most obvious flaw in their argument being that they (deliberately?) ignore how Amazon's price affects other sales channels.

  18. Re:Coverity on Put Your Code in the SWAMP: DHS Sponsors Online Open Source Code Testing · · Score: 1

    Well, considering the budget of the DHS, they're going to do the right thing once in a while, purely by accident. ;-)

  19. Re:Coverity on Put Your Code in the SWAMP: DHS Sponsors Online Open Source Code Testing · · Score: 1

    Sorry to break it to you, but Coverity's free-open source scanning was originally funded by the DHS. :-)

    After the DHS grant expired in 2009, Coverity continued the service pro bono.

    This new program seems like a step back, though. Now, if the DHS was instead investing in improving the open-source tools, it would make sense.

  20. Re:Blade Runner's script had little to do with Rid on Ridley Scott to Produce Philip K Dick's The Man In the High Castle · · Score: 1

    I believe it was his call that the world be dystopian rather than utopian.

    Well, the book was pretty darn dystopian... (well, it was a Philip K. Dick book). Scott did throw out Fancher's original script, which focused on the envionmental themes of the book, to instead focus on the question of humanity; a good thing too, because it's a much more compelling theme.

    Scott, Mead, Ford, Hauer hell, even Vangellis never was better.

    Let's not forget the work of primary script writer, David Peoples, who also authored the Clint Eastwood western Unforgiven. Two very different films and yet sharing a surprising number of commonalities.

    I can also say that, having read "Man in High Castle", that's not an easy book to put to film.

    Then again, neither was Do Androids Dream of Electric Sheep?, and yet Blade Runner is an example of a near-perfect adaptation, even if the film, taken literally, retains almost nothing of the original book. (As PKD said, "The two reinforce each other, so that someone who started with the novel would enjoy the movie and someone who started with the movie would enjoy the novel.")

    It could work. Although Ridley Scott's later work has been quite uneven, in my opinion. But fingers crossed.

  21. Re:this is great news! on Open-Source Blu-Ray Library Now Supports BD-J Java · · Score: 1, Troll

    You are doing it wrong. Netflix at the highest bit rate is similar to BluRay, and they support 4k which is even better (and yes, the bitrate is adequate). As for downloads proper BluRay rips clock in around 10GB of an average 1.5-2 hour movie.

    You don't know what you're talking about. Netflix's "Super HD" 1080p is 7 Mbit/s. A single-layer two-hour BluRay movie can be 18 Mbit/s and still leave room for an hour of extra material. The codecs are the same.

    Sure, I don't mind the quality of a 10 GB H.264 BluRay rip; I wouldn't be able to tell the difference compared to the raw BluRay rip... which clocks in at 25 GB or more. But I can certainly tell the difference when I compare with the 6.3 GB Netflix "Super HD" version!

    As for 4K, what's the point, when most movies are still mastered in 2K (Full HD)? Iron Man 3, Noah, Dawn of the Planet of the Apes, every bloody Transformers movie... they're all mastered in 2K!

  22. Re:Maintenance for all trains is high on The Improbable Story of the 184 MPH Jet Train · · Score: 1

    Not quite. Passenger trains have priority, and only lose it when they run late and even then, it is not that freight has priority over passenger service but that it does not have to yield to passenger trains.

    Fair enough (though your Wikipedia reference doesn't really support your claim), but in much of Europe, the passenger trains do have right of way, even if they're running late. Any freight trains on the way are literally sidetracked to allow the passenger train to run at full speed.

    I've only noticed this once; the train had been behind schedule and running slowly for a little while, and the driver came on the intercom to apologize, noting that we were just waiting for the freight train to get out of the way, so the passenger train could overtake. A little later, we sped up and drove past the cargo train, which was just sitting still on a shunting track in the middle of nowhere, allowing the passenger train to overtake on the main line.

  23. Re:Dark X.....Negative X on Cosmologists Show Negative Mass Could Exist In Our Universe · · Score: 1

    They filled up the Dark X meme, so now are switching to the Negative X meme to explain oddities.

    Yeah! This whole "negative number" concept is outrageous, who do they think they're fooling?!

  24. Re:Systemd? Not on my system... on X.Org Server 1.16 Brings XWayland, GLAMOR, Systemd Integration · · Score: 1

    Systemd vs init: [...] complexly and half-assed, vs [doing] one thing very very well.

    SysV init doing anything "very very well"?

    HAHAHAHAHAHAHAHAHAHAHAHAHAHAHA!

    (phew) Thanks, that brightened my day!

  25. Re:300 on board, 23 US citizens on Malaysian Passenger Plane Reportedly Shot Down Over Ukraine · · Score: 1

    Not kidding, only trolling. Idiot.