Slashdot Mirror


User: poemofatic

poemofatic's activity in the archive.

Stories
0
Comments
241
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 241

  1. my 2 cents on Nmap Author Receives FBI Subpoenas · · Score: 3, Interesting

    Why? What's wrong with a narrowly tailored subpoena in regards to a specific, discrete illegal act?

    No, the question is "What's wrong with getting a valid subpoena *before* asking for the logs?" The issue is not the worthiness of the cause, but relying on general security paranoia and flag waving to bypass due process. Fyodor is right to demand a valid subpoena -- if the FBI is such a bumbling set of wankers as to not be able to come up with a subpoena, why trust them to accurately identify the suspect, or to not abuse the information they get?

  2. Re:great news! on The Extinction of the Programming Species · · Score: 1

    Don't worry, you spent 4 years getting an education, learning new things, reading great books, forming your own opinions, and making friends. You are an older, smarter, and wiser person for it. Oh, wait, you studied CS?

  3. Easy on IBM Tech Detects & Changes Spin of Single Electron · · Score: 1

    So what do we do if quantum computers can decrypt anything in almost real-time?

    We just hop on our flying cars and head to the nearest AI advice dispenser, who'll tell us what to do.

  4. Re:Unfortunately not on First Bank Transfer via Quantum Cryptography · · Score: 1

    I recommend spending time reading the thread. Out of band channel means traditional crypto, or no crypto at all. In other words, they have not solved the problem of securely distributing keys. which is the claim to which my original post was responding.

    One more time:

    Case 1:
    You are going to rely on traditional crypto for the security of the key agreement protocol, why rely on Quantum Crypto in lieu of a Diffie-Hellman step?

    1a-If you are worried about "infinitely" powerful quantum computers, then those computers will break the traditional crypto you rely on and compromise the system.

    1b-If you are not worried about this, then why not rely on practically secure crypto throughout -- this way you are not vulnerable to the "fickle physics" attack.

    Case 2: You do not rely on traditional crypto at all. You rely on non-crypto "out of band" security:

    The non-crypto out of band security must deal with the 80%+ bits which can be determined by an attacker via cloning attacks. Therefore your pipe needs to provide confidentiality via physical security. --- why bother with a key exchange if you have an always on confidential physically secure pipe?

  5. Unfortunately not on First Bank Transfer via Quantum Cryptography · · Score: 1

    since there is no (QC) authentication, so you are not *securely* transferring anything. Moreover, even if there was authentication, only a fraction of the data is assumed confidential. To get a key stream, you have to apply a classical hash, but leaking a portion of a one time pad leaks data, so the whole system is as secure as the classical crypto hash and the classical means of authenticating whoever you are sending the key stream to in the first place. Snake oil (so far.)

  6. Every church is threatening on SimChurch · · Score: 4, Insightful

    The import thing to realize is that a church, like any other social group, has certain mores and conventions -- typically they are inherited from the ambient cultural group.

    Example1: Jesus didn't say anything about homosexuality, but he did mention that remarriage after divorce was a sin, and that the resulting relationship was adulterous. However, most churches today are OK with divorced couples marrying, having sex, and having a family, but they are not ok with gay sex or marriage. The difference is the cultural norms in their surrounding community have accepted one, but not the other. As soon as gay marriage becomes overwhelmingly accepted, it will be treated in the same way as divorce and bans on interest bearing loans.

    Example2: The Southern Baptists split with the Northern Baptists over slavery. You can guess which baptist congregation thought it was a sin, and which one thought it wasn't. Both had scriptural arguments.

    Example3: The U.S. is a society which focuses on individual success resulting from individual action (e.g. hard work, clean living.) Other cultures are more focused on collective success and collective responsibility (e.g. good schools, effective legal system, social welfare.) Therefore the U.S. churches "spiritualize" this bias by focusing on individual sin/repentance (being personally saved), as opposed to group sin/repentance (social justice), although one must look for relatively rare discussion of the former in the scriptures, since almost all exhortations in the old and new testaments, revolve around the latter. Indeed, most American Christians would consider it discrimination to be punished for something which they didn't individually do, but did* as a group, whereas the Bible is filled with examples or promises of group punishments (punishment of a race, of a generation, of a city.)

    Now, getting back to the original point, if you find yourself not sharing the mores of your church (i.e. you think interest bearing loans are cruel exploitation, or you are gay) then your positions will be opposed in the church, as they would in the larger community. However, the *difference* is that opposition in the church is often interpreted as "God disagrees with you" which, to a sincere believer, is much worse than the community disagreeing with him. Indeed each church believes, although there is a long history of previous churches in other cultures gettings things wrong, that *now* the truth is revealed, and *they* have the correct word of God.

    And, adding to this ostracism phenomenon, is that we have a very fragmented culture, broken up into many little pockets, each of which have different mores, and so the odds are good that the church you randomly pick will not share your views. Finally, people move a lot, and so can easily find themselves in a place where there is no church that they feel they can go to, and still remain a sincere believer, without a lot of inner tension.

    In this way, *every* church is threatening.

    And there is no real solution, but it's certainly a step backwards to classify a church as "bad" if someone says it's threatening, since this just perpetuates the assumption that some church subcultures (e.g. adultery ok, homosexuality not ok) are better than others ("committed" homosexuality ok, adultery not ok.) The reason why this can't be the case, is that all of the subcultures are formed out of confused, fallen people, and then each church inherits the mores of it's ambient group. For instance, Jesus, when discussing adultery, made the point "This is wrong, but you were too weak, so Moses let you grant a certificate of divorce. Nevertheless, it's adultery. In fact, even wishing to have sex with a married woman is adultery." So basically each church makes allowances for accepting "sinful" behavior that is predominant in the community, and does not accept "sinful" behavior that is on the margins.

    The only recommendation I have is to do some work and find a church that you can live with. In a major urban area, this should b

  7. No, but.. on Monday Releases Cause Crashes · · Score: 1

    it *does* mean that they don't give a shit about input validation, which is pretty much the same thing.

  8. Rant:Dell R&D Correction on Why iPod Can't Save Apple · · Score: 2, Insightful

    Dell does no R&D.

    R = Research = inventing new technologies
    D = development = transforming those (new!) technologies into marketable products.

    Dell may now pay the salaries of a few engineers and hardware designers who make sure certain chipsets work correctly, but this is neither R nor D, it's engineering.

    IBM does R&D
    Intel does R&D
    Lucent does R&D
    Apple does (some) R&D
    SUN does R&D
    Dell does a little engineering on top of the boxes it assembles.

    Note that by the same standard, bug patches or standard features do not count as R&D in apple's column either. Except when the feature is sufficiently innovative to constitute a new technology (e.g. a new approach to voice recogniction, a usability breakthrough, an SMP innovation, or microprocessor design.)

    I know in our current era, every engineer's fart is some new valuable IP that counts in the R&D column, but let's not kid ourselves as to what research and development really is.

  9. Re:The security of any protocol on AirPort 3.3 Extends WPA Security · · Score: 1

    No my point is that because it's a system. the weakest link will be the password. Attempts to strengthen the system so that a weak password is not exploitable are bound to fail and end up covering only a few avenues of attack.

    In a mutual authentication system, the client is protected from a dummy server as well. If you do not think this is important, then you don't care about all of the attacks to spoof websites (paypal). I do care about these attacks and don't consider a protocol in which I pass a password to an anonymous DH partner as somehow better than a real challenge-response requiring mutual authentication.

    As for financial institutions, the protocols that I am aware of (VISA/ANSI X9/AKEP family) use keys generated from decent entropy sources, are ALL "vulnerable" to attacks on the key, and do not rely on password obfuscation attempts, or assumptions that the attacker is passive.

    And you haven't given me an example. :)

  10. Re:The security of any protocol on AirPort 3.3 Extends WPA Security · · Score: 1

    Sure, but you are making the protocol too dependent on the rest of the system, and the behavior of the rest of the system will change.

    Have you ever tried to design a server with account lockouts for incorrect password entries? Think DOS.

    Can you give me an example of a single authentication protocol which is secure against weak passwords? I will let you use whatever mitigation metric of your choice, provided that you let me stipulate that it be production code, which must support a massive number of simultaneous connections, a fixed percentage of which always fails to authenticate. Also, the protocol you select must truly be resistant to offline dictionary attacks when the attacker actively spoofs either party (e.g. client or server.)

  11. The security of any protocol on AirPort 3.3 Extends WPA Security · · Score: 1

    is bounded by the entropy of the key. If you use a weak key, it will be vulnerable. This is not a legitimate criticism of the protocol.

    If you are worried about someone accessing your network, then you have to assume the attacker is active (can insert messages and attempt to authenticate), so eliminating offline attacks doesn't buy you much. AFAIK, this is the case with all authentication protocols.

    Just pick a good key (e.g. flip some coins.)

  12. Theory vs. Practice on Outsourcing Winners and Losers · · Score: 4, Insightful

    -If your software project is pushes the boundaries then programming is more difficult.
    -If your project is underfunded, underspecified, and open to change, then managing it is more difficult.

    Now, where on this spectrum do you believe most software development efforts fall?

  13. This means that on Is it Just Me, Or Is Our Mainframe Missing? · · Score: 4, Insightful

    to access your data, I have to know your publicly available ID and I have to have access to the phone in your (unlocked) cubicle.

    How well does your company pay their cleaning/janitorial staff? Suppose a coworker went into your cubicle and called IT from your phone -- how would security find out who did it?

    I would assume that they would need to see your ID (as well as you) before resetting your password. If that is too burdensome, then have a system in which you contact your manager or HR. One of these can then log in through a secure connection and file a password reset request with your ID to the remote IT support site. The fact that they are logged in (with their password) at least ensures there is a starting point for an audit, and the odds of impersonation are less likely.

  14. Except on Washington State Restricts Anti-Cop Videogames · · Score: 1
    that police forces are drawn from distinct population pools:

    military burn outs; if you served in the army, then many states allow you to avoid the already minimal community college educational requirements. A GED + 10 years in a military base is not preparation for a "peace" officer.

    Low IQ males, who are of a "good guy"/"bad guy" mindset. The police in my experience do not understand they are supposed to be peace officers instead of law enforcement officers (this role is reserved for judges and juries.)

    To add to this, our legislators are forcing a series of low level "wars": against poor neighborhoords, against drugs, against the homeless, and against activists. (In Colorado, the police department was found to keep a "watch" list of liberals, civil rights advocates, and environmentalists)

    As a result, many of us frequently see poor or marginal people beaten up, harassed, abused, and arrested. The same police officer will offer an "Can I help you sir" to a white guy in a suit and briefcase.

    Real reform will only come when the police start treating the white middle class the same way they treat the groups they are at war with.

  15. Re:NULL pointers and error handling on HTML Rendering Crashes IE · · Score: 1

    Safari is beta software (yes, it does crash a lot) that users may download from Apple. IE is a flagship MS product that is bundled with the OS, and is integrated into the windows explorer gui (and into the kernel). This accounts for the panty moisture difference.

  16. don't forget on UK ISP Imposes Download Limits · · Score: 1

    If you are downloading and uploading Office docs, then that 4Gb wont last very long..

  17. You just don't get it. on Deutsche Bahn to Sue Google · · Score: 2



    This isn't a question of proving that the information on the site has a "legal" use. This is about the right to think and speak whatever you want, as long as that act of speech, in and of itself, does not hurt anyone else. Yes there are caveats for defamation, etc. But the point is that thought is difficult without speech, and if I want to fantasize, or discuss, the best way to blow up a railroad, then I -- as an autonomous person -- should have the right to do so. It's about privacy, about getting the thought police and speech police out of our lives, and letting people express themeselves.

    A better way to fight crime is to, god forbid, do good police work, while also tackling whatever underlying issues may contribute. But forbidding people from talking about crime is not a legitimate way of fighting it. Banning racial epithets does not decrease racism. Actually bringing these things out in the open, and allowing people to discuss what is on their minds is a much more effective way of fighting crime, while also preserving our freedom to voice unpopular opinions.

  18. who cares? on Amazon & Used Books II: Bezos Strikes Back · · Score: 3, Funny



    I think my responsibility to ensure an author's income is the same as the author's responsibility to do the same for me. Zero. If I can't afford to buy his book, then he doesn't get my cash. If he can't afford to make a living on selling copies, then I don't get his works. Simple stuff.

    Why do we always have to justify or excuse exercising our first sale rights on the grounds that this will be good for the industry?

    According to this logic, if someone can show publishers are seeing declining revenues, well then kiss your first sale rights goodbye. And say hello to the big brother world of realtime, privacy-invasive, content controls on every damn thing you buy.

    Finally, and to balance the debate a bit, we need to reestablish the legitimacy of sharing, borrowing, loaning, and conserving the things we use. Share a lawnmower with the neighbors. Carpool. Loan out the books you aren't reading, make mix compilation CD's of your favorite music and give them to your friends, invite your neighbors over for dinner. Buy a newspaper and then pass it on to your coworkers when you are done with it. Loan a friend some of your DVD's or VHS tapes. Trade videogames. Borrow that cool salad bowl the old lady upstairs uses. Loan out your fishing poles. Be part of a community.

  19. Re:Very impressive on Google Ad-words Poetry Project · · Score: 3, Interesting

    because their "spell check" is not a dictrionary, but the web itself.

    Conceivably, if a majority of indexed webpages began using "pron" then the next time you type "porn" google will ask

    did you mean "pron"?

  20. sortof on Mixing Gigabit, Copper, and Linux · · Score: 1


    but according to the IEC it's better to say "Gibibit" or "Gibibyte", etc. when referring to binary numbers.


    Look at the national institute of standards' web page dealing with base-2 units.

    So the hard-drive makers are right, but can still be flamed for a lot of other reasons:)

  21. Re:Dumb question for the /. editors.... on Microsoft Gives Up on Hailstorm · · Score: 2

    money is the only thing that pays for itself. Funny how that works.

  22. not in this case on Behind The "Work-At-Home" Street Spam Signs · · Score: 2

    since (from what I'm reading) Herbalife is selling the IDs these signs. Unless the management of herbalife is thoroughly insane, they know exactly where the signs end up, which is why they don't want their name on them.

    Punish one ID for putting up a couple of signs? nothing changes. Force Herbalife to stop its guerilla marketing strategy or pay big $$$, and I think the streets would get a lot cleaner pretty quick.

  23. You have a point on Slashback: Bnetd, Salmon, Towers · · Score: 2



    but the laws are (or should be) decided upon actual code, rather than vague notions.

    Currently, the way Intel decides who they "allow" onto their system is determined by how they configure their mail servers. There are exceptions for cracking and some very weak (civil) penalties for unsolicited commercial email. That's it.

    But instead, they sued after the fact for "trespassing" -- when there's no law to suit your case, just make the crime fit the law.

    The fact that Intel might be able to get away with this is, in my opinion, more troubling than the actual emails which were sent out. Imagine if a company could sue for trespassing anyone who sent an email through it's servers, that management afterwards decided they didn't like. Can Taco sue the trolls around here, when they play games to bypass the lameness filter? If I get pissed off, and write an email to my working group, can I be sued for trespassing? What if I write an email and ask someone else to forward it -- will that party be trespassing? I think the whole approach is wrong. If Intel uses an intra-net that's firewalled off, and someone hacks into it to send an email -- well, fine that's trespassing. But for an internet and mail server connected to the net, trespassing is just ludicrous. Until some anti-spam laws are actually passed that do not restrict themselves to commercial email, they should have no case. And I hope you see the folly of passing any such law.

  24. Fuzzy memories on One-Time Pad Encryption With No Pad? · · Score: 2

    tell me Adobe interlaced the word "encrypt" with the actual text, thereby claiming the work was "encrypted". Could just be an urban legend, but you gotta love it.

  25. good question, on France Legalizes Mobile Phone Jamming · · Score: 2

    with several different answers.

    1) Suppose you are having a dinner with relatives/friends, and someone gets a call and starts a conversation at the dinner table. Does it bother you? If so, why? Does it make a difference if everyone else is also talking to another party?

    2) Suppose you are in a restaurant and someone starts combing their hair, or putting on some deoderant (discreetly, yet clumsily under their shirt). Does this bother you, and if so, why?

    My answers follow, but it all boils down to showing lack of respect.

    1) The ringing noise interupts movies, conversations, etc.

    2) talking on the phone is a private thing. If you don't believe me, then ask yourself if you would mind if a stranger asked to tap some of your calls, randomly. Private things are a taboo, and work both ways. So I, for one, feel uncomfortable listening in on someone else's call just as much as I feel uncomfortable knowing that my own phone call is being listened in on. Whether it's panhandling, farting in public, brushing your teeth, crying -- the embarassment is experienced by both the instigator and the object/witnesses. Add to this that with visual thigns you can look away, but sound is hard to hide from. And when people _voluntarily_ do a private act in public (as opposed to an involuntary fart), they become the source of anger.

    3) Partly because of 2), when someone takes a call, they are signalling to the rest of the group that their call is more important to them than what the rest of the group is doing. In addition to 2), they remove themselves from some common activity, and engage in something else -- without leaving. This offends people because it seems ostentatious.

    4) Many cell phone users are quite loud, gruff, and often talk "shop" in settings such as restaurants and recreational areas. They are often arrogant, give orders, and remind people of what they hate about VC's,managers, and other "plugged-in", self-important people. Unfortunately, in many quarters, "soccer moms" checking up on their kids are not viewed much higher than VC's. There are class/cultural issues.

    5) Those who are recreating want to get away from work and not be reminded of it. They often pay a lot of money just to experience a certain atmosphere. Using a cell phone in a crowded city street may just make someone sneer at you, but using one in an expensive restaurant makes people angry. With dimishing free time, this issue becomes more important, even if the venue is not a very expensive one.