Slashdot Mirror


User: gstoddart

gstoddart's activity in the archive.

Stories
0
Comments
14,230
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 14,230

  1. Re:A rose by any other name... on After Twenty Years of Flash, Adobe Kills the Name (thestack.com) · · Score: 2

    As long as I can turn it off, I don't give a crap what they call it.

    Flash has pretty much had at least one gaping security hole for every month of that 20 years.

    And in the 19.5 years I've been disabling/uninstalling/blocking it, I've never felt like I was missing anything. The sooner Flash finally dies and goes away the better.

  2. Re:When will enough be enough? on Sued For Using HTTPS: Companies In Crypto Patent Fight (theregister.co.uk) · · Score: 1

    Fuck everything, we're doing five prongs!

  3. No, I'll make this explicit: this is a web-cam, pretending it's a security/alarm system.

    Buy a nanny cam. Buy a better door lock. Buy a dog.

    This is about the same level of protection that a typical alarm company offers you.

    I very much doubt a typical alarm company is providing you with something which is broken on the level of this thing

    The entire authentication process is decoupled from the actual device, and attackers can easily spoof device IDs and gain access and control over someone else's alarm system.

    To make matters worse, nothing is encrypted, all communications are blurted out in cleartext, there is no message integrity protection mechanism and no sequence numbers for network packets.

    Sorry, but that level of defective is beyond anything you can try to excuse.

    But then again, people seem to have accepted that IoT will have security written by blind and drunk monkeys, but that it's good enough. So you buy one, and I'll continue to believe the IoT is just another opportunity for assholes in marketing to pretend they have a useful product.

  4. Re:The IoT of now and the future. on IoT Home Alarm System Can Be Easily Hacked and Spoofed (cybergibbons.com) · · Score: 1

    This just goes to show you that even with a security-centric product like an alarm system, even basic security features cannot seem to be prioritized over cost or first to market.

    You know, looking at their company history, I'd say they're a video-centric product, which some ass in marketing decided to start selling as a security-centric product.

    "The RSI Videofied system has a level of security that is worthless," concluded the Cybergibbons team. "It looks like they tried something and used a common algorithm - AES - but messed it up so badly that they may as well have stuck with plaintext."

    Sorry, that's not security. That's pretending you have a product that has any business being used in security.

    Epic incompetence. Be that at the management or technical levels, it really doesn't matter.

  5. Re:Is this really as typical as it seems? on IoT Home Alarm System Can Be Easily Hacked and Spoofed (cybergibbons.com) · · Score: 1

    My guess would be that they were told to implement it in a certain way. They may have had objections but were overruled by managment.

    To the consumer, incompetence by managerial decree is impossible to differentiate from incompetence technical design.

    The product's security is shit. Why it's shit is irrelevant.

    So, sure, blame whoever you want. The key thing is here that as many people as possible should be told the product is so terribly insecure as to defeat its entire purpose.

    Unless, of course, actual security isn't the purpose. In which case it's doubly important to tell people not to use it.

  6. today we hear about an IoT smart home alarm system that works over IP. Made by RSI Videofied, the W Panel features no encryption, no integrity protection, no sequence numbers for packets, and a predictable authentication system. Security researchers who investigated the devices say, "The RSI Videofied system has a level of security that is worthless.

    So, the makers of the "W Panel" are lazy, incompetent people who have no business making a security system? Or they're greedy, cheap people who have no business making a security system?

    Blah blah blah Insecurity of Things written by people who are either incompetent or indifferent to security, yet another product which is more marketing than substance, and yet another product which sounds like it's utterly useless.

    Tell you what, can we assume all IoT shit is broken, defective, and insecure ... and then only have the stories when someone builds one which isn't?

    Yet another product created purely by the marketing and sales people, and stunningly incompetently done at the tech level.

    They make know something about video. But apparently they don't know a damned thing about security. This is worse than vaporware ... this is a product which is so utterly unfit for the purposes it's being sold for as to be dangerous.

  7. Huh? on Rikers Inmates Learn How To Code Without Internet Access (fastcompany.com) · · Score: 5, Insightful

    learning the basics of programming, despite having no access to the vast educational resources on the internet

    Bah, when I learned programming there weren't "vast educational resources on the internet".

    It's been done.

    Since when the hell have we reached the point of "zomg, someone learned something without teh intertubes"??

    Because if other people haven't learned to basics of coding over the last few decades without the use of the internet, I'd be completely shocked. The internet is not a pre-requisite to learning, as much as people seem to think it is.

  8. Re:OK, so I can use it anyway I choose? on Companies Want To Insert Ads Into Unicode (thenextweb.com) · · Score: 1

    If they make it part of Unicode, they should lose all ability to tell me what I can do with that character.

    If they wish to have "an emoji clause", then they should be getting told to piss off and go away now.

    As I said ... either it's just a character, and they have no right to ever say anything about how that character is used ... or it's a trademark they wish to restrict, and it has no business being in unicode.

    But letting corporations stake out parts of the unicode standard AND continue to tell us how we use those unicode characters simply cannot be made to work, because they're incompatible things.

  9. OK, so I can use it anyway I choose? on Companies Want To Insert Ads Into Unicode (thenextweb.com) · · Score: 1

    So if KitKat and Durex get their own emojis, then I can use those emojis any way I choose and without licensing or trademark considerations?

    Because that's what happens when you put it into the standard code pages.

    So I can put (KitKat)(Condoms)(Donkey)(TacoBell)(IceCream)(PartyHat)(Cigarette) ... and KitKat and Taco Bell have NO legal right to say anything about how I use that image, right?

    That will be awesome, and I'm sure the marketing clowns will love what happens when they make their trademark part of a standard code set. Because if you make it part of my standard character set, you turn your trademark into something which anybody can use.

    What you can't do is turn your trademark into a standard part of what is in Unicode and then demand I have restrictions on how I use that trademark.

    So either they are idiots who plan on diluting their trademark. Or they are idiots who think they can put their trademark into a standard character set and have no control over how it is used.

    We should NOT be putting corporate defined images into Unicode unless there is an understanding that what people then DO with those things is no longer under any control by the people who asked for it to be there.

  10. Re:thats strange on VW Officials Knew Since Last Year of Misleading Fuel Economy Claims (reuters.com) · · Score: 2

    But those worse figures wouldn't be what VW advertised, they would be advertising the better 'regular' numbers.

    And then you would demonstrate you don't know the law around those numbers.

    Car makers have ZERO option except to publish the EPA approved numbers. They MUST publish the EPA numbers. The problem is the official EPA numbers are meaningless, derived from a fairly old process, and not indicative at all of actual mileage figures.

    So, using those EPA numbers, hybrid owners have been really annoyed to find they're not getting anywhere NEAR the mpg they've been told -- because the hybrids were measured using the old and not-very-useful formula. Similarly, 15+ years ago, I knew people with diesel VWs. Those cars regularly got more mpg than they could advertise, because for those cars the formula was fairly useless in the real world as well.

    The important thing here is that, right or wrong, high or low ... car makers can only legally give their mpg numbers based on an EPA formula which is, effectively, an estimate based on a calculation. If they tried to use other numbers they would get into trouble.

    VW would advertise based on the only number they're allowed to. They can't cherry pick the ones they like; which means you could get significantly worse or better than the EPA figure. Even if the EPA figure is pretty much known to be meaningless and out of date.

  11. Re:IANAL, but I know one & on VTech Hack Exposes Data On 4.8 Million Adults, 200,000 Kids (vice.com) · · Score: 1

    You seem to imply there is legal "duty of care" (or whatever you'd call it).

    They don't care. They never promised to care. The license probably says they don't care. The people who run the company don't care.

    Taking steps to care presupposes they care. If they don't care what happens to your "sensitive data", they're sure as hell not going to take steps to protect it. Because that would involve caring.

    What part of greedy corporation shielded by license agreements and only interested in their own profits do people not understand here?

    Oh, and did I mention that the license probably includes terms which says you can't sue them and need to agree to binding arbitration in a forum of their own choosing?

    And that forum of their choosing will simply say we don't fucking care and never promised to.

  12. Re:Come on on VTech Hack Exposes Data On 4.8 Million Adults, 200,000 Kids (vice.com) · · Score: 2, Insightful

    This is just embarrassing. There's absolutely zero excuse for SQLi these days.

    Define 'excuse'.

    Lazy. Incompetent. Indifferent. Greedy.

    The usual set of 'excuses' apply here. And as long as companies have no liability for crap like this, it will keep happening.

  13. Re:Uber and pirate bay on Swedish Court: ISPs Can't Be Forced To Ban the Pirate Bay (thelocal.se) · · Score: 4, Insightful

    I guess the people with money are allowed to bend the law now and apply it how they see fit

    More accurately ... the copyright lobby has bought and paid for laws which they interpret how are applied, enforced outside of the judicial system, with abysmally low thresholds for evidence ... and with shockingly little penalties for them if they misuse it.

    In case you have missed, copyright related laws have reached a special level of stupidity, because they've been paid for and written by the people who benefit from them. This shit is now routinely entrenched in high-level treaty negotiations, where governments act on behalf of the interests of multi-national corporations -- and literally just use whatever text provided by the lobbyists.

    They're not bending any laws, they're outright financing the adoption of laws which are entirely written to give them massive amounts of latitude to do as they please without penalty.

    Governments these days are pretty much openly working for the corporations in this matter.

    Copyright is like kiddie porn and terrorism; it lives in a special place outside of most other forms of laws, and builds in shortcuts and bypasses to legal protections you would normally have.

    This is way beyond bending the law, it's about buying their own laws.

  14. Honestly ... on VTech Hack Exposes Data On 4.8 Million Adults, 200,000 Kids (vice.com) · · Score: 4, Insightful

    VTech doesn't use SSL web encryption anywhere, and transmits data such as passwords completely unprotected. ... Hunt also found that the company's websites "leak extensive data" from their databases and APIsâ"so much that an attacker could get a lot of data about the parents or kids just by taking advantage of these flaws

    Just stop using this crap ... over and over and over and over we see these same damned stories.

    Stop handing all this information over to companies who are too indifferent and incompetent to give a shit about how badly they misuse your data.

  15. Re:Now only if... on Swedish Court: ISPs Can't Be Forced To Ban the Pirate Bay (thelocal.se) · · Score: 5, Interesting

    Yeah, well, don't hold your breath ... if the US doesn't launch some form of trade sanctions I'll be surprised.

    The US is leading the charge on entrenching in law that the copyright cartel has absolute veto over technology and the internet.

    There's a reason why US foreign policy has been pushing to have treaties include this shit, and why the representatives of the copyright lobby are effectively writing the text of the laws and treaties -- and it's because the US politicians have been bought on behalf of these industries.

    I wish more rulings like this would happen, and these clowns would find themselves on much shorter leashes (if not short ropes and long drops).

    But things like the TPP and every other treaty has proven that the US government is essentially now working on behalf of the copyright cartel, and are prepared to keep giving them bullshit laws which give them all the power, and with little or no penalties and oversight.

    Copyright owners have far more legal rights than you or I, and increasingly an accusation of copyright supersedes your right to have someone show you their evidence.

  16. Re:Hmmm ... non-gold gold on Scientists Turn Gold Into Foam That's Nearly As Light As Air (www.ethz.ch) · · Score: 0

    LOL ... you know, the fact that I ended my post with the words "such drivel" was intended to telegraph the whooshiness of what I posted.

    Instead, allow me to present you with your very own: whoosh.

  17. Re:Soo... Aerogel? on Scientists Turn Gold Into Foam That's Nearly As Light As Air (www.ethz.ch) · · Score: 1

    I guess its novel to use the method with gold, but the idea is more then 100yrs old.

    You DO realize that TFS even mentions aerogel, right? And that it's mentioned like 5 times in TFA?

    NOBODY is claiming this is a 100% new idea, they're saying they've managed to do it with gold, and that they can influence the color based on how they do some of the steps.

  18. Re:This is *SO* unethical ! on Montana Newspaper Plans To Out Anonymous Commenters Retroactively (washingtonpost.com) · · Score: 1

    The only "sadly" involved is users sadly not reading what they agree to.

    In general I disagree with the premise of contracts which one side can change unilaterally ... but I acknowledge it exists, which was what I was saying.

    Oh, so you DO get it. What are you bitching about, then?

    Maybe you should read my fucking post and the person I was responding to?

    I'm not defending it. I'm saying it exists, it's widespread, and at the end of the day short of not participating in it, or giving them false information ... there's not a hell of a lot you can do about.

    WTF are YOU bitching about?

  19. Hmmm ... non-gold gold on Scientists Turn Gold Into Foam That's Nearly As Light As Air (www.ethz.ch) · · Score: 3, Funny

    I think the market is under-served by not having non-gold gold.

    The implications for the hip-hop and gold-tooth industries are staggering, as suddenly bling is no longer confined to being gold, but can be other non-gold colors.

    People have been saying for years that gold should come in other colors, as gold was just too damned boring.

    When asked if creating non-gold gold would create confusion among buyers of gold, as well as creating higher change of fraud due to non-gold-gold gold being produced to be represented as non-gold gold, representatives declined comment citing they were not authorized to speculate on such drivel.

  20. The other alternative is the content-management software is garbage.

    Me, I'm laying my money on that one.

    Don't go assuming these papers are building some specialized platform with software experts, they're buying a commercial product which does as much as the vendor made it to. Or worse, they're subscribing to a 3rd party to provide it, and in the process that 3rd party gets all your info anyway. I believe that's what disqus is for.

    Sometimes, a competent person will tell you that, no, the software can't actually do that. My bet is the company who made it never built it to be able to do that, and the paper is so invested in having the comments they're not willing to care how this policy change impacts anybody.

    And you can bet that if it comes down to keeping the comments because it adds value to their site (probably more than their own reporting does), or worrying about YOUR privacy ... they don't give a crap about you.

  21. Re:This is *SO* unethical ! on Montana Newspaper Plans To Out Anonymous Commenters Retroactively (washingtonpost.com) · · Score: 4, Informative

    Who do they think they are to say, in effect "I have changed the terms of the contract. Pray I don't change it again," because now they've shown that their agreements are not really agreements.

    Sadly, EULAs and the like tell them they can do this. Courts have upheld it. Which means taking them at their word is pretty much useless.

    I don't disagree with you, but corporations who wish to make money off your personal information, they don't give a crap about your privacy or any fallout to you.

    Real names policies exist because companies say "what value can I get from selling the fact that SuitWrinkler53 commented on the website?" and deciding that they can't sell that information.

    They claim it's so they can police the content and keep things civil. But those comments add value to those sites, which is why they want to keep them.

    But never ever assume you can or should trust a website with this information. Unless you're doing a transaction in which they need a billing address, giving random websites your actual information pretty much guarantees your information will be sold, collated, analyzed, and used for marketing purposes.

    It is not that I am âoeunwilling to configure our software so that comments posted before the new policy is implemented remain under chosen screen names.â I extensively investigated that possibility and was unfortunately told by our content-management software experts that such a configuration is impossible.

    And then you realize they don't know much about the underlying technology, and are probably using something like WordPress.

    You can trust a corporation to do one thing: look out for their interests. And you can safely assume they don't give a crap about your interests, which means the more you stop giving websites your real information the less they have it.

    If I was faced with a website which wanted my real information, I would choose not to use it. Because I don't give a crap what most websites think, and I don't give a damn why they feel entitled to that information.

    When I walk into your store, if you asked me for my real name and address, I'd tell you to fuck off. Why on earth would I give this to you when I visit your website?

    The problem is people keep pretending like the internet is trustworthy, or that those agreements are binding or permanent. They just have to remind you it's technically private property, and that the license says they can change the terms if they wish.

    Oh, and don't forget that the comments are probably managed by a 3rd party, who has their own license, and doesn't give a crap what you think about it.

  22. Re:Ministry of JUSTIVE prevents access to INTERNET on UK Prisons To Crack Down On Inmate Internet and Mobile Phone Use (thestack.com) · · Score: 2

    but being a pissant wanker in ensuring that people in the system have no access to reality, life, the Internet, and the ability to be part of even an online society, research their case, case law, or learn

    Part of the point of being in prison is you get denied some of these things. That's kind of the point.

    When someone has an illegal phone in prison, they could be using it to plan escapes, run their criminal empires, or plan witness intimidation. You know, stuff like this:

    Although landline communications in prisons are monitored by authorities, mobile communications can go under the radar. A fact sheet published this year on unauthorised phone use in prisons, outlined that mobile phones were being used by âoeserious organised criminals to import firearms and drugs, co-ordinate escapes and to arrange murder.â

    Think of the Mexican cartel leader they tunneled out of prison.

    Justice, in this case, means ensuring you aren't still actively engaged in criminal activity. You know, the actual job of the ministry of justice.

    So, boo hoo, criminals may not be getting unfettered access to the intertubes. That's what happens when you are in prison.

  23. Enough with the proprietary ... on Lenovo Patches Serious Vulnerabilities In PC System Update Tool (csoonline.com) · · Score: 4, Insightful

    Time and time again these companies roll their own version of something, and time and time again it proves to be a failure.

    Let the OS maker build the tools to manage the OS, this way when that is found to be defective we all get the same update.

    This is one of the reasons I utterly hate OEM installs, because they put so much extra garbage on the machine as to render it almost useless.

    My mother-in-law's laptop needed to have about a dozen or so "helpers" (ie shitware) disabled to make the machine usable, otherwise it was spending most of its time trying to see if it could be helpful and perform tasks which were already done.

    Make a good quality laptop, and sell it to us. Make sure to write drivers for your stuff, and if you can't do that use someone's stuff which does have drivers.

    And then leave the rest of the damned OS alone.

    Just because someone in marketing wants to brand the experience and differentiate the product doesn't mean you're actually capable of delivering on this.

    As often as not these "helpful" tools cause more problems than they could ever hope to fix.

  24. Re:Short FPC history and goals overview on Free Pascal Compiler 3.0.0 Is Out; Adds Support For 16-Bit MS-DOS, 64-Bit iOS (freepascal.org) · · Score: 2

    Twenty-three years ago, development started on the first version of the Turbo Pascal and later also Delphi-compatible Free Pascal Compiler

    No, Turbo Pascal is not 23 years old ... the grammar suggests that, but reality doesn't.

    I know this, becaise 23 years ago I had a second hand 286 PC with Turbo Pascal on it. And it wasn't exactly new even then.

    Turbo Pascal has been around since 1984 .. that would be 31 years ago.

    So, you can argue the sentence should have read as "Twenty-three years ago, development started on the first version of the Turbo Pascal (and later also Delphi)-compatible Free Pascal Compiler".

    But what you can't do is argue that Turbo Pascal is 23 years old. Because that's utterly incorrect.

  25. Re:Oh, really? on Apple Looks To Introduce OLED Displays In iPhone Models From 2018 (thestack.com) · · Score: 3, Insightful

    The baboon screeching and shit flinging would never cease.

    Yes, it's called the internet .. that's kind of what if does.

    And it's been like that since before you could explain it to your mom.