Slashdot Mirror


User: memoryhole

memoryhole's activity in the archive.

Stories
0
Comments
46
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 46

  1. Re:Repercussions and Security Theory on SourceForge Server Compromised · · Score: 2

    The idea would be not that the server doesn't have to store the password - but that the password in plain text never reaches this machine. And, in plain text, never reaches ANY machine in it's plain-text entirety. You split the username and password into pieces, and have several different servers verify the pieces, and then report back to the central server (the one you're attempting to log in to) that this user - who never sent the central/login server a single bit of his username/password - is okay. If *any* of the verification servers (and losing one is okay, because they're all interchangeable - if one's gone, send it to another in the verification server pool) reports back "bad!", then the user is not authenticated.

    Now, obviously, the details are fuzzy, but hey, that's life. :-)

  2. Re:Repercussions and Security Theory on SourceForge Server Compromised · · Score: 2

    Nifty!

  3. Repercussions and Security Theory on SourceForge Server Compromised · · Score: 5

    What I find particularly interesting about this whole deal is how their distributed network setup has worked against them. Reading the wording of that email closely, you notice that you are being asked to change your password because you MAY have used the system that was compromised. They don't actually know.

    And even if they did know, would that help, I wonder? Is user information distributed within the SourceForge network, or is there a more central login server that warehouses all of that information? Either case, when you think about it, is somehow not exactly what you want to have happen. If all user login information is in a central location, cracking that one location would instantly compromise everyone's account information. However, distributing user information around the network (aside from making login management more difficult) makes it more likely that if a random server is cracked at least *somebody*'s account information will be compromised.

    It occurs to me that a distributed, and cryptographically fragmented form is the most desireable - because then cracking any one machine would give you exactly nothing in the way of user account information.

    Now, the rest of the problem is people who use the server that has been compromised. They send their usernames and passwords to this compromised server (unawares, of course) and thus their information is compromised, obviously. But does it have to be this way?

    I propose that it is conceivable to build a login system where no one server receives an entire piece of a login. The login name is split into two character pieces, for example, and sent to as many servers as necessary along with an MD5/SHA1 sum of the full username - each server verifying that there exists a login name with those two letters in that particular position, and they are associated with that particular cryptographic sum, and nothing more. Notice that the controlling server (the one that you're logging in to) never sees any piece of the login name - but is merely informed (by the client) which machines (in no particular order) the login name pieces were sent to. A similar trick could then be played with the password - sending pieces of the password to some password verification servers, with a cryptographic sum of the verified login name. So, each server never has a record of full login names, and no server ever is sent the full login name.

    To bad no such system exists, eh?

  4. The REALLY Insidious Part on Gracenote Sues Roxio Over Switch to Free Song Database · · Score: 3

    If Gracenote wins this lawsuit, it sets up a very interesting, and dangerous precedent for using the DMCA. What it suggests is that ANY competitor to ANY company in ANY field can be sued similarly.

    Think about it. Say I have a company that sells word-processing software (eg, Microsoft). This lawsuit would suggest that I could sue another company (eg. AbiSoft or Corel) for providing a service that directly circumvents my (Microsoft's) methods of copy protecting. Or say I have a company that sells CPUs (eg, Intel). Say another company provides the exact same, drop-in replacement service (eg, AMD). This lawsuit would suggest that Intel can sue AMD for providing a method of circumventing Intel's copy-restriction methods.

    What this lawsuit basically says is that the DMCA can be used to prevent people from using competing products - especially if the competing products are free! But regardless of the price...

    FreeDB is a separate entity from Gracenote, uses it's own database and it's own servers. In all respects, FreeDB is merely a competing company. According to the DMCA, is competition a federal crime now?

    Perhaps the sticking point is that FreeDB is a "free" alternative. However, this suggests that hostels and homeless shelters can be sued by, for example, Hilton, because the homeless shelters provide a free replacement for Hilton's services.

    This, is truly creepy.

  5. Linux - the Peter Pan of Operating Systems on What Linux Must Do To Survive... · · Score: 4
    I've been saying exactly what Emily does for a while now. Linux is a SERVER operating system. It's a HOBBYIST operating system capable of getting into the IT rooms simply because it's an OS people get passionate about. Every time I hear someone say "Linux is ready for the desktop" I just wanna shake some sense into them.


    The thing is, this non-unity is inherent to the design and sould of Linux. Linux can never be user friendly precisely because it is a hacker's machine. Who else but a hacker would be happy that almost all programs are distributed as source so that they can be compiled for any platform that Linux supports?


    One of the things that this article touched on but didn't go into detail about is the installation procedure for most software. With Linux, if you're lucky, there's an RPM or a DEB somewhere out there (but those are frequently distribution specific, are usually written by someone other than the author of the software, and are frequently poorly done), but really it's practically impossible to properly maintain a Linux box without gcc or some other compiler. And what about Windows? Simple installer. Sometimes these installers aren't very good - but almost always the software will be installed and will run. With MacOS it's the same thing. There's never a library that you need to get. Even Linux applications that have been ported - jed, for example, has a Windows version. Do you need to install slang on Windows before jed? No, of course not. This is at once Linux's strength and it's fatal flaw.


    I absolutely agree that Linux needs standard hardware specs. So far, Linux's general attitude has been "we'll run on anything!". But only sort of. And there's not always full support for a specific piece of hardware. And there are always bugs. I have yet to find an ethernet card whose MacOS drivers had "issues" where it couldn't do certain things, or crashed the machine under certain circumstances. Why? Because Linux is almost like an art form here - it's NEVER done.


    So anyway, I absolutely agree with Emily's assessment of Linux. And though I love Linux to death (I'm a computer geek - and computers are my hobby), Linux is the Peter Pan of operating systems. It refuses to grow up - because with a little fairy dust and a happy thought, it can really fly.

  6. Seems reasonable, but this will have repercussions on Harlan Ellison on Copyright Infringement · · Score: 4
    He has a point. There is a rough assumption that every time you rip off a song or an article or a book, the only people you're hurting are rich beyond your own wildest dreams anyway. Which is partly true - publishing houses, record companies, and so forth are very rich, and get the lion's share of the funds garnered from book sales or record sales. The artists, on the other hand - especially of books - get very very little.


    At the same time, this is an interesting side to the argument - and one that it doesn't seem is concidered very often. The recording industry (and I use them because the case is fairly analagous) typically says that it's fighting copyright infringement on behalf of the artists. But book sales and book authors are people we haven't really heard from before, and authors typically don't have as rich a lifestyle as many recording artists do.


    Does this make it fair to infringe the copyrights of music artists, but not fair to infringe the copyrights of book authors? Well, no, not really. That's the catch. It looks like this lawsuit of his - if he doesn't run out of money - will have some pretty big repercussions on the online music debate, fair use dialog, and general DMCA discussions as a whole.

  7. Linuxcare on Red Hat Abandons Sparc · · Score: 1

    Oh, you mean the same Linuxcare that was GOING to have an IPO in June, but decided not to because of "market conditions"? This may or may not be the real reason - and it's a perfectly legitimate reason. But it doesn't sound like a support structure I'd want to depend on for mission-critical systems.

    When companies invest time and hardware in a service or operating system, they expect to do BUSINESS with a BUSINESS. The idea of freedom is antithetical to the entire idea of a business, and as such, they don't understand or like it (as a general rule). When you buy Windows, you are doing business with Microsoft. If you have a problem, you call Microsoft. When you buy RedHat, you are doing business with RedHat. If you have a problem, you call RedHat. When you download and install (or buy a copy of from CheapBytes.com) Debian, you are NOT doing business with Debian. Debian isn't a business. When you want support, you call some third part that had nothing to do with creating the OS? This may make sense to some people. This makes sense to people who understand the OpenSource ethic. This does not make sense to businesses.

  8. Debian Isn't Unified Enough on Red Hat Abandons Sparc · · Score: 2

    Yes, I know, Debian (being the cool people that they are) has compiled a version that runs on sparc. And in the sense that they support the rest of the Debian distributions, the sparc version IS supported. But who is going to be the primary sort of people that run sparcs? Big companies perhaps?

    The fact of the matter is that Debian simply does not have the same kind of real tech-support that RedHat does. You can't call someone at the Debian corporation and demand to know how to get Apache to stop segfaulting. You can't call Debian and ask for a recommendation between web-traffic analysis programs, or credit-card-verification systems. You can't call Debian at all - it's a collective. There is no real responsibility, because no one person is doing anything. There is no headquarters. Instead there are consultants who agree to give Debian advice. Tech support is an IRC channel. This isn't how a big business prefers to do business. There's no culpability, and above all, no one to sue when it all goes south. Debian's form of support is GREAT when they're dealing with individual users - heck, I'd even venture to say it's the best out there. But for a company, they don't want to have to rely on IRC (where someone can just sign off without answering any questions). They don't want to have to rely on consultants with no real tie to the COMPANY that provides the Debian service - and especially not when they charge a minimum of $100/hr.

  9. Linux Cross-platform Binaries???? on Why Hasn't Apple Released Quicktime For UNIX? · · Score: 1

    Would xanim binary plugins be cross platform? Could I run them on LinuxPPC? Could I run them on Linux-sparc? Linux-m68k? Could Microsoft come up with an interpreter to suddenly add Sorenson support to MediaPlayer with such binaries?

  10. RPM's on XMMS Plugin Competition Closed - Voting Started · · Score: 1

    If anyone wants RPMs of most of the XMMS plugins (src rpms or ppc rpms) check out ftp://ftp.linuxppc.org/incoming and ftp://ftp.linuxppc.org/contrib

    They're very simple - for default installs of XMMS only, but they work.

  11. What about Hardware? on Interview: Ask Antitrust Experts About Microsoft · · Score: 1

    I've noticed that the hardware side of Microsoft's business is never mentioned. What role would the near-vertical-monopoly that Microsoft has on certain aspects of computing play in the trial?

  12. Depends on what the article says on Linux on a Magazine Cover? · · Score: 1

    ...but, if it says that (as it should) Linux is up and coming, but nowhere near as capable (graphically) as other systems, then you probably had best just go for something indicating that Tux has an artistic side. For example, Tux with a beret and a paint pallete painting something that looks suspiciously like the GIMP logo on his canvass - something to that effect. Or, you could put the MacOS logo on a pedestal, and have Tux painting a picture of it (MacOS being THE graphics OS, more or less).

  13. Soundtrack on On Hollywood and the Portrayal of Computers · · Score: 1

    Go for the third Hackers soundtrack - equally good.

  14. NOT even CLOSE to Microsoft's Acquisition Lineup on Apple Reverses G4 downgrade · · Score: 1

    >like they did to Power Computing, Newton Inc., Claris (oops, it's starting to sound like Microsoft's lineup of acquisitions, isn't it?).

    Um, just thought I'd mention, Newton Inc and Claris were both Apple spin-offs. Every Newton I've ever seen has had an Apple logo on it, and Claris? Well, it was originally a combination of the MacDraw, MacWrite, and othe Mac* programs. I don't think this even comes close to Microsoft's lineup of acquisitions.

    If this news story shows one thing, it's that Apple changes its mind whenever it pleases. It changed its mind when clones started leeching sales, it changed its mind about spinning out the Newton (to kill it, basically), it changed its mind about Claris (because it was offering the same software functionality and ease to Windows, AFAIK), it changed its mind about 33.6 modems in iMacs, it changed its mind about charging for AppleShare IP upgrades...when you think about it, Apple changes its mind A LOT. It responds to the market. People don't like something and make motions about it (the iMac modems, AppleShare IP, etc.) it changes.

  15. Nervana on Ask John Carmack About Quake - or Anything Else · · Score: 3

    What is your opinion of Nervana's Psi Visualization engine (the analog, post-script-type 3D environment description language, described at www.nervana.com)? What possibilities does it have for 3D gaming, and do you intend to do anything with it?

  16. Hello People!! You don't get it! on Microsoft Plays Linux Games at Work · · Score: 5

    FUD? Rigging results? Please. Microsoft may make common practice of that, but that is NOT what's going on here.

    According to the fellow in question, they were performing a "useability" study. That means just that: useability. How easy is Linux for people who are not already accustomed to it to use?

    So, why are they having people do studies on Linux? It's competition, and anyone who wants to compete will take a gander at the competition.

    Why are they using "newbies"? Think about this. What good would it be to do a "useability" study on WordPerfect 3.1 using people who have already memorized all the fkey combos, or who know to look for fkey combos? NONE! Why? These people have already adjusted to the environment, and so any reports they have on how "useable" that environment are are SKEWED. People who don't know to read the manual, and don't know much about linux (or even computers, for that matter) are PERFECT for a true "usability" study. They allow a clearer look at how obvious and easy it is to do what you want to do. The question of useability attempts to answer the question: what do I have to learn in order to use this? Do you have to learn to install software in at least 5-6 steps (gunzip, untar, cd, ./configure, make, make install)? Or are things as easy as clicking a single icon? Do you have to run applications within a terminal, calling them up by exact capitalization, or do you get a big friendly icon automatically? When something goes wrong, how easy is it to fix? How easy is it to get help? This is useable to people who don't already know all the proper commands, aka. born-and-bred Windows users who might want to stop using Windows for some reason. Microsoft wants to know "how easy is it to switch"? Do they have to worry?

    In this case, the answer is a resounding NO. Linux is complicated. Many if not most applications are distributed primarily in source-code format, which requires compiling, which requires installation of all the development libraries and toolkits, which requires keeping up with the most recent versions of these same libraries, which involves visiting ftp sites, which involves knowing about ftp-commands....and if not that, it requires discovery of rpm and it's man page, which requires discovery of man pages (not exactly the first thing that comes to mind when presented with a command prompt for most people), or it requires the discovery of gnorpm (not advertized as much as it is), which requires knowing why you need to be root for some things, but don't want to be for most things. Even just typing "help" provides you with a bewildering list of commands and a fairly cryptic set of symbols describing their use - BUT NOT WHAT THEY DO! (please, is anyone so deluded as to argue that any os that provides "trap [arg] [signal_spec ...] or tr" when you type "help" is immediately useable?) Is the "/usr/bin" directory the first, most obvious place to look for a new game you just installed?

    Suffice to say, to use Linux pretty much at all, you need to know A LOT about how it works, how computers work, how unixes work - some mixture thereof - to get ANYWHERE.

    And why would they want to find out how "useable" Linux is from someone who already knows all about how to use and configure it? They don't. Because that information would be WRONG. At least, it would be in all areas that they care about.

    Yes, it's funny. No, I don't know why. But it's newbies because that's the only kind of "useable" that counts for the mass market. "Useable" means "really fricking obvious" in the mass market. What's obvious to you and me is quite often nowhere near obvious to anyone else. Microsoft may be all about FUD, but that's not what it's doing here...at least, not yet.

  17. Quartz == (PDF + QuickDraw) on Ask Slashdot: Comparing the GUIs · · Score: 1

    The latest news from Cupertino says that Quartz has support for all (or almost all) QuickDraw calls, to make things easier for developers and to allow people to run old applications. After all, Apple spent such a long time finessing the QuickDraw API that it's a shame to just ditch it. (And it's also a really elegant API, if I do say so myself...not that it couldn't be better, but it's very nice). The PDF thing is just Apple seeing the light.
    Oh, and DPS was not dropped ONLY because of licensing issues, it was also slooooow. Think about it, a nice, high-quality laser-writer takes it's time imaging complex pages WITH A HARDWARE-BASED RASTERIZER! Just imagine how slow things would get when you have a few windows open. To make things really fly, they'd have to put a couple of those chips on either the mother-board or the graphics board, and THERE Adobe makes a killing.

    Now, here's a thought. Can someone come up with a windowing system that will ditch the dependence on pixels? I'd like to be able to say "I want my icons an inch square, and I want my text to be 12 points" and have that really mean something at ANY resolution. I don't want my 12 point text to become 12 pixels high and darn-near-unreadable at 1600x1200 - I want them to be 12 typographic points high (that's 12/72's of an inch tall) and VERY smooth. Is there such an animal? Was NExt like that?

  18. Re:Oligopoly, yes it is! on AOL acquires WinAMP, Spinner, SHOUTcast · · Score: 1

    Oligopoly, as defined by Mirriam Webster is:" A market situation in which each of a few producers affects but does not control the market."

    The few producers line indicates multiple owners, whereas AOL is a single entity. But in any case, even if Webster had said "each of a few products..." the term still wouldn't make sense when applied to this situation, since the products that AOL controls - Mozilla, ICQ, AIM, AOL's main network browser, and WinAmp - all are players in very different markets from each other. Therefore they cannot and do not "control" any of the markets that they are a part of any more than Slashdot can be said to have a monopoly over the nerd-news website market.

    Realistically, the only market that AOL can be said to have a controlling interest in is in the independent chat clients - AIM and ICQ are the most widely used. Even there, ICQ has so many viable clones (if mostly for Linux environments) that they cannot be said to have a monopoly. Besides which, there are still products like Yahoo!'s pager, IRC clients, and Java-based chats that many people still use (which may be an Apple vs Microsoft type of argument) - but that monopoly, if you want to call it that, has existed for a while now.

  19. AOL is no Monopoly on AOL acquires WinAMP, Spinner, SHOUTcast · · Score: 2

    A monopoly isn't only tight control over an industry, or even loose control over an industry. That's only one type of monopoly - a horizontal monopoly. The other kind of monopoly, vertical, is where you control everything required to make a product or products - from essential minerals (or just basic components) all the way through to the finished product which allows you to far undercut the prices of other vendors who have to buy their supplies regularly. For example, a corporation that owns oil rigs, oil boats, refineries, gas stations, tanker-truck outfits, and an advertising company can be said to have a vertical monopoly even if they don't own ALL of a certain kind of business.

    So, how is AOL a monopoly? It doesn't own the majority of IP's, nor does it own a vertical monopoly as far as I can tell. Perhaps if they made their own modems and computers, or if AOL was used for nearly ninety percent of all internet data transfers (averaged by number of files, not bytes transferred).

    As it stands, AOL is merely a company with it's fingers in a whole bunch of pies. Adobe, Corel, and Macromedia can all claim the same.

    Of course, Microsoft is a different issue, because they control the OS, the hardware, and most of the major software packages - AND they don't play fair. As far as I have heard, nothing AOL has done truly deserves the stigma of "Monopoly". Yet. It is a disturbing trend here, but I'm waiting for the AOL-only games and AOL-Office suite of applications.

  20. Is this so bad? on "Intel Inside" campaign shackles OEMs · · Score: 1

    You have a point. I was wondering about the fact that MSNBC is pushing the story...seeing as how we all know exactly where the MS in MSNBC came from. Distract attention perhaps? This is all a big red-herring from the king of kings of disinformation, redirection, and monopolistic business practices. Whoop-dee-doo that Intel pays people to hawk their products as long as they stick to a few conditions. You could say the same thing about television - Intel pays the broadcasting company a certain amount to hawk their product, but will refuse payment if certain conditions are not met. This isn't exactly unusual.

  21. Still Work? on A tiny protest makes a big noise · · Score: 2

    The article says that the sign waving and marching, while it identifies more with the 60's than the Millenium, still works. How exactly does it still work? It got media attention, but is that what people were after? Come on, a simple publicity stunt? I thought geeks were above that kind of thing - leave that crap to corporations. The refund was the focus, the idea of people taking Microsoft up on it's written agreements - indicating that they, as Microsoft supposedly encourages, read the entire liscensing agreement, and then disagreed. The focus should be that Microsoft won't hold up it's end of the bargain. The focus should not be to scream to the world "Look at us! Aren't we cool! We can hold signs and protest! Just like our parents did! We're original!" Come on.

    So, instead of a publicity stunt - an act which says nothing good about the character of the open source community - call this an attempt at holding a major corporation to the written agreements that it has distributed so widely and held people to (for anti-piracy). If that's what it is - which it should be - then the pickets and signs and screaming at television cameras just like they did in the 60's did NOT work. What has changed? Anyone who was paying attention is either A) Microsoft and unconcerned, B) a OSS supporter and feels the same as he did before, or C) unrelated observer who now thinks Linux people are trying to make a big noise and are doing it in a rather annoying and rude and OUTDATED way. The method for getting attention these days is not to wave picket signs anymore. No one cares about demonstrations anymore, and they're a little wary of them since people started getting killed in abortion demonstrations. The way to get attention these days is stated in three words: "Class Action Lawsuit".
    And that should be the next step. Hold Microsoft and the suppliers of the computers to the agreement that they distributed with the computer. THAT's the way to get respect and attention - especially from the movers and shakers with money on Wallstreet. THEN, you'd have something that would reflect well on the community. Not some few extremists shouting slogans and indignation into a camera. Please. If you can't be respectable, at least ACT like it.