Slashdot Mirror


User: danFL-NERaves

danFL-NERaves's activity in the archive.

Stories
0
Comments
35
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 35

  1. Trusting the Untrustworthy is Bad on Firefox SSL-Certificate Debate Rages On · · Score: 1

    Self-Signed and expired SSL certs are bad. Users clicking through to trust bad certs is worse. Firefox making that practice difficult is good.

    If a user runs into a situation where the cert looks wrong they SHOULD NOT be able to easily click through. This doesn't discourage users from using encryption. How likely is it they can work around the encryption error? It discourages them from blithely trusting the untrustworthy.

  2. Re:Unfortunately, what else is new? on Paul Vixie Responds To DNS Hole Skeptics · · Score: 5, Funny

    Your mad ad hominem attack skills have convinced everyone that Paul Vixie is the know nothing douchebag in this conversation. Kudos!

  3. USB 2.0 to IDE/SATA and Media Sanitation on How to Say Goodbye to Old Hard Drives? · · Score: 1
    I've had great luck with the Sarbent USB 2.0 to IDE/SATA adapter kit for connecting my PC to old hard drives for backup. It was so nice to avoid shutting down my system, opening my case, connecting drives and booting back up again and again. Even on a work bench without case it's a pain and a half to reboot each time. With this kit all you have to do is disconnect the device via the task tray icon then unplug it. Plug the next one back in and you are good to.

    Before disposing of the drives it's also a good idea to sanitize the media. A good guide is NIST's SP 800-88 Revision 1 Guidelines for Media Sanitation which will give you more than enough detail on how to securely dispose of those drives.

  4. OLPC Success is Assured on Dvorak Slams OLPC As 'Naive Fiasco' · · Score: 1

    If Dvorak calls it a failure then it's guaranteed success!

    Dvoraks Law of Inverse Opinion: Where John Dvorak opines one state the reverse state is invariably true.

    A long time ago I took him seriously and waited on buying a computer because he said PowerPCs running Workplace OS would sweep the market. Heh... Last time I made that mistake.

  5. C7?! Mmmm... Padlock crypto goodness. on Wal-Mart's $200 Linux PC Sells Out · · Score: 1

    I'm going to have to temporarily suspend my moral embargo against buying from Wal-Mart if they have a $200 PC with a C7 chip. The C7 is a beautiful little chip with all sorts of hardware cryptography begging to be taken advantage of. Via's Padlock engine is an amazing and underappreciated tool that security geeks would do well to take note of. And if this Linux is using the 2.6.22 kernel it'll have all the tools baked right in to take advantage of that raw cryptographic power. I use an MSI Axis 700 system running Gentoo Hardened for my firewall/VPN package and love the performance.

  6. Windows Officially Supported on Review of Asus Linux-Based Eee PC 701 · · Score: 1

    According to Asus the Eee PC will have models with Windows as the preinstalled OS. Guess that means it will run some version of Windows but the press release has very little in the way of details. Bet the price difference will be stark given the probable additional hardware requirements and Microsoft licensing fees.

  7. Re:Worrisome on Under the Hood of AT&T's Monitoring System · · Score: 2, Informative

    The date you mention is when the product was made.

    It wasn't turned against the US citizenry until much later, post 9-11. The information on when that occurred is in the previous articles.

  8. Book lover me on Digital Books Start A New Chapter · · Score: 2, Interesting

    I love my books. I have lots of paper ones and lots more electronic ones. But when I spend my money on books I always buy the paper even though I would prefer the ability to grep my recycled electrons. Why?

    When I buy a paper book I can:
                Read it anywhere, at home, in the office or on the road
                Lend the book to a friend
                Sell the book
                Give the book away
                Photocopy a page for my notes
                Photocopy a page to pass to a friend
                Read it in a year
                Read it in a decade
                Have my grandchildren read in 100 years from now

    When I buy an electronic version of a book I can do none of these things. It all depends on the license and on the technology. For some reason the publishers have the impression that because it's electronic that consumers no longer expect the same rights.

    I do.

    Beyond the licensing issue is the technical issue. That book isn't going to be readable in a few years when the current reader and DRM technology is defunct. In ways far removed from the restrictions publishers may impose are the restrictions that the technology will impose. A portable reader will only last so long before it requires a new charge or a replacement. A portable reader will die if it gets wet, not require a few minutes with a blow dryer. A portable reader limits the number of places I can enjoy a book in a way that a paper book does not. And if the reader is not portable I will be restricted even further in where I can read. So an electronic version of a book is of less value to me than a paper edition.

    And yet it almost goes without saying that the publishers will try to charge more for the electronic edition.

    But I won't go entirely negative on electronic books. They have many benefits to me when they are implemented in a consumer friendly way. Here are the instances of electronic books being superior to me:

                I like being able to search my books. This is especially important with technical volumes where I need specific information and I need it now.
                I like viewing books efficiently and for novels that means using Rapid Serial Visual Presentation to read quickly and with excellent comprehension.
                I like being able to concentrate the knowledge bound in books a single location so I can find them when I need them. 1000 books on a disk weigh no more than 1.

    So while I am the epitome of the book reader, large library appreciating geek who adopts new technology quickly I will be staying away from electronic books until publishers learn to play to the strengths of the electronic edition and not lock them away from their most interested adopters.

  9. No More Spam on What Do You Want in a Job Website? · · Score: 1

    How about fewer spams from resume broadcasters? How about fewer spams from automated 'recruiters' trolling for personal information for spams? How about fewer spams from multi-level marketing folks for 'exciting opportunities' and 'new franchises'?

  10. The obvious on The Future of MP3 and Surround · · Score: 1

    Surround Sound MP3?! Ooooh, wow! Gotta switch to that right aw ... Umm... Wait a second here.

    Who releases audio with surround sound information? Do you often see CDs touting surround sound? What is the point of surround sound in an MP3 if the only way to add that information is by getting a sound technician to remaster from source material?

    What a useless 'innovation'.

  11. What does EAL4 mean? on Windows Gets Independent Security Certification · · Score: 5, Informative

    Copied verbatim from the Common Criteria v2.1 specification. I can't make heads nor tails of it:

    Evaluation assurance level 4 (EAL4) - methodically designed, tested, and reviewed

    Objectives

    EAL4 permits a developer to gain maximum assurance from positive security engineering based on good commercial development practices which, though rigorous, do not require substantial specialist knowledge, skills, and other resources. EAL4 is the highest level at which it is likely to be economically feasible to retrofit to an existing product line.

    EAL4 is therefore applicable in those circumstances where developers or users require a moderate to high level of independently assured security in conventional commodity TOEs and are prepared to incur additional security-specific engineering costs.

    Assurance components

    EAL4 (see Table 6.5) provides assurance by an analysis of the security functions, using a functional and complete interface specification, guidance documentation, the high-level and low-level design of the TOE, and a subset of the implementation, to understand the security behaviour. Assurance is additionally gained through an informal model of the TOE security policy.

    The analysis is supported by independent testing of the TOE security functions, evidence of developer testing based on the functional specification and high-level design, selective independent confirmation of the developer test results, strength of function analysis, evidence of a developer search for vulnerabilities, and an independent vulnerability analysis demonstrating resistance to penetration attackers with a low attack potential.

    EAL4 also provides assurance through the use of development environment controls and additional TOE configuration management including automation, and evidence of secure delivery procedures.

    This EAL represents a meaningful increase in assurance from EAL3 by requiring more design description, a subset of the implementation, and improved mechanisms and/or procedures that provide confidence that the TOE will not be tampered with during development or delivery.

    Assurance class
            Assurance components
    Class ACM: Configuration management
            ACM_AUT.1 Partial CM automation
            ACM_CAP.4 Generation support and acceptance procedures
            ACM_SCP.2 Problem tracking CM coverage
    Class ADO: Delivery and operation
            ADO_DEL.2 Detection of modification
            ADO_IGS.1 Installation, generation, and start-up procedures
    Class ADV: Development
            ADV_FSP.2 Fully defined external interfaces
            ADV_HLD.2 Security enforcing high-level design
            ADV_IMP.1 Subset of the implementation of the TSF
            ADV_LLD.1 Descriptive low-level design
            ADV_RCR.1 Informal correspondence demonstration
            ADV_SPM.1 Informal TOE security policy model
    Class AGD: Guidance documents
            AGD_ADM.1 Administrator guidance
            AGD_USR.1 User guidance
    Class ALC: Life cycle support
            ALC_DVS.1 Identification of security measures
            ALC_LCD.1 Developer defined life-cycle model
            ALC_TAT.1 Well-defined development tools
    Class ATE: Tests
            ATE_COV.2 Analysis of coverage
            ATE_DPT.1 Testing: high-level design
            ATE_FUN.1 Functional testing
            ATE_IND.2 Independent testing - sample
    Class AVA: Vulnerability assessment
            AVA_MSU.2 Validation of analysis
            AVA_SOF.1 Strength of TOE security function evaluation
            AVA_VLA.2 Independent vulnerability analysis

  12. Re:Security and Trust on Nessus 3.0 discussed · · Score: 1
    The reference for this is found at http://www.catb.org/~esr/writings/cathedral-bazaar /cathedral-bazaar/ar01s05.html in Eric S. Raymond's essay on software development, The Cathedral and the Bazaar. He does not cite specific examples or sources but I am sure if you email him he could supply one or two.

    One salient thing to mention is that in the essay he does not specify that the eyes have to find bugs. They simply have to ask the questions that lead the primary programmers, who are often so close to the code as to lack perspective, to examine the relevant code. The e.g. he uses is a tester who asks the developer, "Where are you zeroing that buffer?"

  13. Security and Trust on Nessus 3.0 discussed · · Score: 1

    Nessus is a wonderful product and I support the creators right to determine the destiny of this project. Tenable apparently was facing stiff competition from those who took advantage of the free (as in beer) aspect of their GPL license to open a competing bar.

    My concern with the closing of the source on this project is specific to its function, ensuring security. Security is one of those funny program spaces where perception is all but reality. Enlightened paranoia is the order of the day. And the wonder of FOSS security software is that being able to view the source of the software builds trust in the product.

    One of the main strengths of FOSS software has always been its ability to distribute debugging to many eyeballs. With a successful and mature product such as Nessus the need for this tends to decline as the profesionalism of the creators and community increases over time. However this is not just an Open Source Software product, it is also a Security product. So in addition to distributed eyeballs leading to code maturity they also engender trust to its professionally paranoid adopters.

    Nessus is a good product and it has earned my trust, but one of the reasons I choose to use it and many other security software packages is that they are Open Source. I know that should there be a problem on a consulting job I can pop open the source and rule out the software's culpability. When I have to resort to closed source commercial software I can only depend on the producing company's desire to abate liability.

    But now Nessus lies in a nebulous area between those two examples. And that's cause for unease on my part as user. For Nessus I have no problem continuing to use it and trusting Tenable until cause is shown for not doing that. But whither go I if other FOSS Security tools close source?

    Or something..

  14. Finally, This Confirms The AMD Rumors on Leaked Pictures of Socket F · · Score: 1

    Finally we have confirmation that all future AMD releases will be in Dutch. No English processor releases are being planned.

    If the rest of the rumor is true Intel and AMD will be combining their x86 processor businesses to form the new iAMDutch conglomerate. Will any of us be safe?

    Dan

  15. Note to Blizzard GMs on Blizzard Made Me Change My Name · · Score: 2, Funny

    Never piss off a user with a bigger soap box than you.

  16. Re:Technology vs Ethics on Google's Rasmussen on Google Maps · · Score: 2, Insightful

    What they should do? Google is a corporation. That is, they are a legal entity which was created for the purpose of creating value and limiting the liability of a group of owners. It's mandate is to do whatever it is capable of doing in pursuit of creating additional value for the owners.

    Why would Google have Ethicists 'in charge' of considering the impact of what it does? Ethicists function best when they are able to independently comment on the actions of such corporate entities in a forum conducive to public review and consideration. A forum where an open debate of the pros and cons of actions can be proposed by a plurality of Ethicists and concerned observers. Having an Ethicist in a position where their self interest is coincident with the business interests of their employer seems like a situation designed to marginalize the ability of the Ethicist to affect change.

    Dan

  17. Re:The King and the Chalice (only for Experts!) on Your Favorite Math/Logic Riddles? · · Score: 1

    Perhaps an error was introduced in the rephrasing of the original question but I think the only two important lines in the question are:

    "The king has a dungeon in his castle that is shaped like a circle, and has n cell doors around the perimeter, each leading to a separate, utterly sound proof room."

    and

    "Since I first locked you and the other prisoners into your rooms, have all of you been in this room yet?"

    So, the King is the person who has locked each prisoner in a cell. The King is located in the central room. Each cell is accessed from the central room. So every prisoner must pass through the central room to enter their cell. Any prisoner can answer yes as the correct answer to his question.

    All other features of the puzzle appear extraneous to the solution.

    Dan

  18. The Answer on Hacking - Art or Science? · · Score: 1
    "is hacking art or science?"

    Yes.

  19. Options on Tivo Institutes 1 Year Service Contracts · · Score: 4, Informative
    There are other options to the TiVo box, If you are sitting on the fence about getting a DVR you may want to check out these other options.

    Commercial Products and Services:

    ReplayTV: TiVo's ancient nemesis, it also 'just works'. I can't say whether it is more user friendly than TiVo, but it is far more customer friendly.

    Windows XP Media Center Edition: Yes, them. Choose from multiple manufacturers but expect to face Microsoft Corp's version of the 'personal' computing experience.

    Hardware vendors are now pushing DVD/HD Recording devices quite a bit. RCA, Motorola and Panasonic have products available.

    Service Providers like Comcast and DishTV are now providing time shifting hardware and tv-on-demand solutions. Check with your choice of cable or satellite service provider.

    Hobbyist Solutions:

    MythTV: The Open Source, Do-It-Yourself DVR. Expect to build your own machine and play around a bit before it works the way you want. (Linux)

    Freevo: MythTV, but not. (Linux)

    MediaPortal: Who ever said Open Source was limited to Linux software? (Windows)

    Meedio: It was a community based freeware product (myHTPC) that morphed into a commercial product without warning. Still a reasonable alternative to Microsoft for PVR function on the Windows platform. (Windows)

    eyeTV: This Mac product has me seriously considering picking up a Mini-Mac to use as a media center. (Apple)

    SnapStream (Windows)

    SageTV (Windows)

    Chris-TV (Windows)

    ShowShifter (Windows)

    On a personal note, I purchased the ReplayTV when it was first released and am entirely satisfied with it. Plus, by purchasing early I have never had to pay a subscription fee for data that is freely available elsewhere. If there had been a subscription fee I would not have purchased it.

    Dan

  20. GNOME for Windows? on GNOME 2.12 Released · · Score: 1

    Hey, where can I get me some of this GNOME goodness for Windows?!?!?1

  21. Viagra Spammers Should Take This Seriously on Pfizer and Microsoft go after Viagra Spammers · · Score: 1

    Microsoft has always been committed to finding a way to keep it up longer (their operating systems, that is).

    Dan

  22. Re:How To, Where To and a Why? on Building Rackmount Cabinet for Home Use? · · Score: 1

    If the equipment is good and set up correctly it can be very easy to work on rack mount equipment, but...

    . If it is in the top half of a 72U cabinet you will want to pull it out.
    . If the sliding rails don't go far enough out to let the lid clear the overlong rack hardware/network switch and cables/impressive computer faceplate/etc. directly above it you'll want to pull it out.
    . If you want to work on the system with equipment you can't carry on your belt you'll want to pull it out.

    And pulling hardware out of a rack is a pain. Unless you opt for the nice server hardware with a universal release backplane you have to unplug the power, network, video, keyboard, mouse, etc. Even for a headless box you still have the power, network and serial cables.

    But thats's just the IMHO thing.

    Dan

  23. How To, Where To and a Why? on Building Rackmount Cabinet for Home Use? · · Score: 1
    Rack mounts aren't good for all situations. You might want to consider the following before deciding that you must have a rack mount cabinet:

    Rack mount hardware is made for business use. This means that the price is set by how much a business would be willing to pay for it. If there were a large demand for a consumer oriented rack mount solutions then you might be able to find less expensive rack mount hardware. As there is not a large consumer demand yet the prices are not likely to drop.

    What are your requirements? Requirement examples would be; physical security (the kids keep hacking my hardware), floor space is at a premium (help, I live in a Manhattan apartment) or display (damn that looks slick). Rack mounts are not necessarily the right solution for the home or office or even the data center.

    Do you like to be hands on with your computer/network hardware? I personally like to be able to take a machine down and rip into it on a workbench. Depending on your rack mount equipment that may be easy or it could become very difficult. In my experience it is usually the latter. (Think of how the dynamics of disconnecting plugs, accessing innards and lifting out hardware would actually work.)

    Do you need a cabinet or will a stand do? If you have wall space available and your equipment is light/small you might consider a wall mount rack.

    If you decide that you are going to go with a rack mount solution, these are my personal favorites:

    Middle Atlantic - These guys have some really neat enclosures that are recording studio quality.

    BUD Industries - Some of the lowest prices I have found.

    MilesTek - Good selection of smaller rack mount solutions.

    If you don't absolutely have to have a rack mount solution then my recommendation is a wire shelving unit and plenty of cable ties. You can come up with a good looking and highly effective bit of equipment. Here are some links:

    Metro Shelving - The big kahuna of wire shelves. Great stuff but can be pricy.

    Costco - Seville Classics Commercial Shelving unit and a bundle of cable ties from Costco is the best $70 solution I have found. (I have four of the shelving units and have no complaints.)

    Dan

  24. With a few tweaks and modz...maybe on Cringely Proposes a Music Sharing Alternative · · Score: 2, Interesting

    While I doubt that a single copy purchase and multiple copy distribution would be reasonable or equitable to the companies and that create, produce, edit and distribute music this idea has some interesting possibilities. What if ...

    Create a corporation. Corporation could either be a co-op or publicly traded with multiple classes of stock. Their would be the normal two classes of stock (Common and Preferred) plus further classes of securities particular to this business. A third type of security would be issued as something like a common stock with a reverse dividend. For example, you could buy into the company by purchasing the stock but then to keep the stock valid you would be required to pay a reverse dividend. The reverse dividend would essentially be a subscription fee at a guaranteed rate. Failure to pay would render the security void, invalidate it for a period of time, change the securities fee schedule or revert ownership to the company. The securities, having a set rate which could cause the stock to increase or decrease in value in relation to the interest rate would be fully transferable so that they could act as something similar to options. (Okay, an investment quality subscription seems farfetched but I just like the idea.)

    The Corporation negotiates use rights with the copyright holders for digital use and redistribution. The contracts here would really have to do two things; guarantee unfettered access to the music by the corporation, allow the corporation to set rates as it sees fit (with no necessary relation between what the corp charges and what the copyright holder receives) and determine a payment schedule agreeable to the copyright holder.

    In regards to the agreements between the corporation and other companies I think it fair to note that it would be VERY important that deals be directly with the copyright holder. Ideally this would be (in order of preference) the author/band/singer/musician, the label/producer, the major label, the distributor and/or the licensing agency (RIAA). The more intermediaries get cut out the better.

    Owners or co-op members could have use of any piece of music on a sliding scale depending on purpose of use and membership type.

    In determining the amount of payment for stock and reverse dividend an equitable use/cost business model would have to be determined. For example, a standard user could download whatever music I like and listen to it without limit. A club or mobile DJ user could download with specific performance rights at a slightly higher rate. A radio DJ could purchase a set of rights for rebroadcast at yet another rate. Bulk use rights could be purchased by radio stations or other rebroadcast entities allowing use of any audio for any length of time. Use rights could allow rebroadcast, restrict redistribution, set quality requirements. The market would really determine all of this so I won't go further into the business model just now..

    Actual payment to the copyright holders would have to be on the basis of real and/or statistical models. This would mean that if you purchased a back library from Xunil Records of 1000 songs then regardless of what you are paid you would have to fairly report the actual use and probable use from a pre-arranged statistical model. So payment to Xunil might be a flat rate of $.10 per track, plus $.05 per download, where 450 songs were downloaded once, 100 were downloaded twice and 50 were downloaded three times. That would mean (1000*.10)+(450*.05)+(100*(2*.05))+(50+((3*.05)). But as we know one download would not mean only one use. The statistical model would have to describe the manner of compensation for any downstream uses.

    The real beauty here is that the company would be handling both distribution and licensing fee collection in a single step. Effectively this would displace bypass RIAA and deprive them of influence in any future digital music marketplace. Any business model that can do this is worth a look.

    Or I might be wrong. :-)

  25. Just One Place on Electronic Music 101? · · Score: 1

    For Electronic Music there is just one place to go:

    http://www.hyperreal.org

    Culture, music, ravers and all kinds of love.

    Dan