Slashdot Mirror


User: bedessen

bedessen's activity in the archive.

Stories
0
Comments
438
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 438

  1. Re:Question on Benjamin Franklin, Civic Scientist · · Score: 2, Funny

    They all traded up to Accords or Camrys.

  2. VPN options on Securing a Private Intranet? · · Score: 1

    Well, for starters, don't use CIPE, vtun, or tinc. If all you're doing is http, you might consider just using ssh to forward the web server ports... but that has the undesireable issue of making all URLs start with "http://localhost/...". Otherwise, it looks like the consensus is FreeSWAN or IPSEC if you are looking for true security with a VPN.

    Some people have said "just use https", I don't think that's a very good suggestion at all. The only thing that SSL really provides in this context is end-to-end encryption, and assurance that the other end is who it says it is. It does not provide any sort of access control or authentication, so you'd have to bolt that on if you don't have it already. From the sounds of it, this application was NOT designed with security as a high priority, and so I would be very leery of exposing it to the world without some layer of encapsulation (as with a VPN) that would enforce access control. For example, https wouldn't protect you at all from things like cross-site scripting errors, or SQL injection, or poor parameter checking/validation, or any of the other common errors that web applications tend to be littered with. Plus, when the attacker breaks through the web application logic they have control of a server on the inside of your network, which is presumably a "Game over man, game over!" type of situation. With a ssh tunnel or VPN, the attacker must overcome password or public-key (or both) authentication first, which is specifically hardened against these sort of attacks.

  3. Re:CNN... on Slashback: Card, Fortran, Legibility · · Score: 1

    Commercial speech is not protected by the 1st amendment. The supreme court has already ruled on this, for example Compuserve v. Cyber Promotions.

  4. Re:Hello small claims court! on California Tries Spam Ban · · Score: 1

    I'd like to see how you plan to sue an open proxy (on a machine in a Korean middle school) in California small claims court. Or any of the other thousands of open proxies in remote places like China, Korea, Argentina, Brazil, etc.

    This bill is meaningless. Almost all spam is injected through unsecured proxies, which are all but untrackable. They're scattered all over the world, and the people responsible for those net blocks seem completely uninterested in the problem.

  5. Re:To repeat a post above... on New Vulnerabilities in Portable OpenSSH · · Score: 1

    You couldn't have just posted a link to the post you copied and pasted rather than plagarising?

  6. Re:Not doubling traffic. on Lousy E-mail Filters Complicating Outlook Worms · · Score: 1

    I don't know what bounces you are getting, but all of them that *I* receive include a full copy of the attachment. Truly, a stunning show of incompetance.

  7. Re:Virus autobounces are stupid on Lousy E-mail Filters Complicating Outlook Worms · · Score: 2, Insightful

    Only on slashdot would someone get moderated as interesting for saying that a phenominon that doubles the rate of junk emails is insignificant because the rate is already high to begin with.

    I don't care if it's growing linearly, exponentially, or factorially. Doubling it means twice as much crap for email administrators to deal with and is hardly "not all that big of a deal."

  8. Re:Can Someone Explain? on ESR to Shred SCO Claims? · · Score: 1

    Try reading for comprehension some time. This method does not compare whole files, it compares small hunks of code, 3 lines at a time. Presumably, this is implemented with some sort of windowing (like the rsync protocol does) so that you can actually compare down to the individual line and not be dependent on where the 3-line boundaries fall. But in any case, it's not just a simple "find . -type f|xargs md5sum" type of deal where you get file-level granularity.

  9. Re:Stupid on AOL Sued For Over-Zealous Blocking · · Score: 1

    Are you showing up in any of the public RTBLs? It certainly sounds like you are adjacent to netspace that is spammer-infested, or otherwise has problems with abuse. If that's the case, then there may not be anything you can do. It's sort of like the business owner that opens a high-scale women's clothing store next to a crackhouse in a bad area of town, and then wonders why no one wants to come in and browse. Even if you are squeaky-clean of spam issues, if you're reselling someone's servers or your upstream likes pink contracts, you will be affected by it.

    I can understand how it would be unpleasant, but the solution certainly isn't to sue AOL and force them to do what you want -- their equipment, their rules. No one has the right to force anyone to accept anyone else's packets. Don't confuse that with me approving in any way of their incompetance... they are two comlpetely seperate issues.

  10. Re:I'm not making this up. on Movie Landmarks for CGI Effects? · · Score: 1

    FYI, it's done by instrumenting all of the parameters of the camera. The computer knows the inclination, azimuth, and zoom of the camera, in realtime, measured by rotary encoders of some kind, I presume. Before the game they calibrate the whole mess by pointing the camera up and down the field, and telling the computer where all the edges are, etc. It then has a fancy model of all of this which it uses to determine where on the frame to draw the line. I don't mean to trivialise it, as apparently it was developed with no small cost and is terribly complex.

  11. Re:Stupid on AOL Sued For Over-Zealous Blocking · · Score: 1

    And the Supreme Court has ruled this as well. In the Compuserve vs. Cyber Promotions (Sanford Wallace) case, they ruled that essentially "your right to spam ends at my door." In other words, nobody can be compelled to pay to accept anything from anyone. AOL can block whomever they bloody well feel like. CI Host has just initiated what spamfighters call a cart00ney, which is an empty legal threat. This will positively get them listed on many private permanent blocklists, becuase if there's one thing that email administrators HATE, it's being threatened by lawyers to accept mail from someone, "or else."

    Now, the issue of whether AOL runs a competent blacklist is another thing entirely. I do think that sometimes they act a bit irresponsible in deciding who to block. However, that's their decision to make. If you feel that email should never be filtered, and that you would never want that happening to you, well don't use AOL as your ISP. I understand that it can be hard to deal with if you are trying to send something TO an aol user and are blocked, but in that case you should make it very clear to that person that they are making it harder for people to contact them by using AOL.

    In other words, I fully support AOL's right to block anyone they don't feel like receiving mail from. That doesn't mean that I agree with the decisions they make, and I would never use AOL for this reason, among others. But that doesn't mean that some two-bit spammer-motel of an ISP can just whip up a lawsuit and compel ISPs to accept their spew. Imaging the consequences if that were the case.... think about frivolous lawsuites from spammers left and right trying to force mail servers to accept their crap.

  12. Re:Be interesting to get geographic map of effects on NZ Spammer Shutdown Makes Big Difference · · Score: 4, Informative

    I've been using Mailwasher to bounce all his spam, figuring eventually his email would show up in the spam lists as being dead

    Please stop. Bouncing spam after the delivery phase is not only naive and stupid, but it makes the life of innocent third parties harder. The From: line is nearly 100% guaranteed to have absolutely nothing to do with the persons responsible for the spam. In most cases it's a random third party, this is called a "joe job." When it happens to you, you receive thousands and thousands of these idiotic bounces (in addition to thousands of angry replies and "please remove" messages) from clueless mail software and cluless users. All you are doing is adding to the problem by "bouncing" spam. You are not bouncing it, you are just forwarding it to someone else's inbox. The only legitimate bounce that you can do with spam is during the mail delivery phase, before the connection has closed. As soon as the message has been delivered, that's it: either delete it or possibly submit it to a spam corpus, but for heaven's sake don't try sending it back to either the envelope-sender or the From: line, as both of these are spoofed and invalid.

    "Bouncing" just adds to the spam problem. Stop.

  13. Re:No wonder... on NZ Spammer Shutdown Makes Big Difference · · Score: 2, Informative

    It's not that microsoft is somehow selling hotmail names. That would be a terrible business decision for them, as it costs them an arm and a leg to deal with spam. If there was a way that they could easily stop it with no false positives (pipe dream, alas) they would. Otherwise they're stuck paying for the enormous bandwidth and storage costs associated with running hotmail.com and msn.com. (Yes, I know there's ad money involved, but I would wager it doesn't come close to paying for operations.)

    The reason hotmail.com is such a spam hole is precisely because it's so popular. Spammers pound the hotmail mail exchangers relentlessly, throwing any sort of likely username pattern at them and seeing what doesn't bounce. I'm sure if MS published their hotmail rejection logs it would be hundreds of thousands of "aaa1aa3a2: 550 No such user here", "aaa3aa4a2: 550 No such user" and so on. The spammers know that there are millions and millions of hotmail accounts, so if they just spew user names fast enough they're bound to get enough successful deliveries to make it worthwhile.

  14. Re:Maybe IBM and SCO are colluding on SCO Announces Final Termination of IBM's Licence · · Score: 1

    Your theory is somewhat plausible, but you have got to realize that it's quite illegal on multiple fronts: fraud, insider trading, securities fraud, barratry, abuse of the legal system, conspiracy, etc.

    What you are basically implying is that the executives of both IBM and SCO sat down and decided that the benefits of this mastermind plan outweigh all the risks -- getting caught, being exposed, third parties mucking it up, etc. You are essentially accusing IBM/SCO of doing something akin to an Enron-level scandal. You've got to remember that IBM is no fly-by-night company, they're a blue chip that's been around for more than a century. To outright suggest that the management of such a company would take such a huge gamble with its reputation, name, and future is outlandish.

    If I came up with some plan that involved IBM executives cooking the books and "skimming the change drawer" on a massive scale (which is about as illegal and corrupt as the plan you sketched), I would be modded down as flamebait for such a baseless accusation. Yet you put some polish on it and it gets +5 Interesting.

    IBM is not so desperate for cash/influence that they would risk such an outrageous plan. It's just not how you do business at the helm of a blue-chip.

  15. Re:eBay knows this happens and doesn't care! on Profile of an eBay Scammer · · Score: 1

    Okay, preface every sentence of the above post with "In my opinion, ..." and it just begins to make sense. Spoken like a true armchair-quarterback. Your whole point is basically that "eBay should do more!" I ask you, what exactly do you want them to do?

    Re: feedback. It's the buyer's responsibility to check, not ebay's. They make that very clear, and if you buy something from someone without reading their feedback and user history, you deserve to get ripped off. If ebay were to automatically take action against accounts with some level of negative feedback, they open themselves up to another vector of abuse. If I don't like merchant X I just make a bunch of accounts, make winning bids on all his auctions, and leave bad feedback -- and now his account is suspended because I'm bitter. And when you change your name, ebay keeps a record of it (and makes the history pretty clear to potential buyers) so they hardly "don't care."

    They limit feedback length on purpose. It's supposed to be a short statement about the deal, so that it can be easily and quickly scanned by other users. If they let people leave pages and pages of feedback, you would get long drawn-out stories of how it was raining that day and joe-bob couldn't make it to the post office becuase his spare tire was not inflated, so it took billy an extra day to receive his widget. That doesn't benefit anyone, when "good merchant but slight delay" functions just as well. Feedback is meant to be taken as trends and in aggregate anyway... you're looking for patterns in the feedback, not specific incidents. Again, someone could always leave some long and scathing feedback becuase they're bitter (for no appropriate reason) or just out of spite.

    Re: safe harbor. Again, what do you expect them to do? Give everyone that complains their money back? That's real smart, then the crooks will just abuse THAT and cost all the legit merchants money. How is ebay supposed to believe either party? In most cases one is lying and the other is telling the truth -- or worse, both are telling a near-truth but omitting or leaving out critical aspects of the story. I'm sure both sides tell a convincing story in most cases, so what exactly is ebay supposed to do? Have them both come in to a lie detector test? Make them swear on their mothers' graves? THey do the best they can, but most of the time the only thing they can do is nothing, without involving the police...

    Which brings me to your whopper of a lie that they "turn a blind eye" or that it's impossible to "involve authorities." Did you not know that ebay allows cops access to almost every aspect of the site just for the asking? It's the kind of big-brother access that any good police state would wet their undies for. If you get ripped it's your responsibility to get the law involved, but once they decide to investigate ebay welcomes them with open arms.

    And finally we have the notion that since ebay is paid by sellers that they couldn't give a rat's ass about the buyer. That is about the most illogical thing I've ever heard. OF COURSE they care about the buyer's experiece. If everyone on ebay was continually getting ripped off, people would have abandoned the site long ago, and there would be nothing to sell (and hence no commissions.) If all ebay cared about was the seller (to the detriment of buyers), then buyers would start leaving in droves, and ebay would become a joke. They have to strive to passify both sides equally.

    I really don't have a love affair with ebay either, and I admit that it is easy to abuse. But that's more a problem of the "I'm buying something from a stranger" situation that is inherent. Other than being omnipotent, what exactly do you expect ebay to do? People always lie, and people are always greedy. If ebay abuse believed every story they received then anyone could say anything and get what they want, and that would be worse then the current situation. If you'

  16. Re:Can't be done. on LavaRnd: A Open Source Project for Truly Random Numbers · · Score: 1

    You're confusing the concept of a statistical distribution with the concept of probability. Example: a fair coin toss will always have a 50/50 distribution of heads/tails if you toss it enough. However for any one specific toss, knowing what the last 1, 10, 100, etc. results were will have absolutely no effect or predictive ability on the next toss. In other words the outcome of a specific single coin toss will be completely random and unpredictable, but in the long term the distribution will always be an even 50/50. Please read any basic statistics text before spewing nonsense about "adding up a whole bunch of strings of random numbers."

  17. Low power FM on What Became of Low Power FM? · · Score: 3, Informative

    Anyone interested in this topic should visit www.prometheusradio.org, notably the newest press releaste titled Broadcast Lobby Caught Red Handed With Red Herring. Basically, the results of a recent independent study show that all the concerns from the ClearChannel-type large broadcast interests were 100% complete FUD. The large stations protested LPFM tooth and nail, under the guise of "it will interfere with our broadcasts." In truth they are just scared of people having access to community radio programming that's not dictated and controled by payola and other corporate interests. All of their interference claims have been more or less completely debunked.

    Hopefully, this will pave the way for Congress to lift the artifical restrictions on LPFM that it imposed a few years ago (at the request of NAB lobbying), and open the door to true community-controled radio.

  18. Re:LAN Parties on Addicted Gamers Succumb To Cybercafe Thefts · · Score: 2, Funny

    Or, you could just get some friends that aren't out to steal your shit. :-)

  19. Re:POSIX is required! on LSB & Posix Conflicts · · Score: 1

    And the lack of availability in 1991 affects the current releases how? "Uh, but it wasn't available when linux was being designed." Ask yourself, how many times have things been redesigned, how many internal interfaces been reworked since v0.1? This argument that because it wasn't online in 91 (what WAS online in 91?) that somehow that affects current compliance is really kind of pushing it.

  20. Re:I use AVG + ZoneAlarm + Ad-aware on Virus Scanners and Process Authentication for Windows? · · Score: 2

    Actually I think the preferred method for busting through software firewalls these days is just to co-opt a trusted program to do your communications for you. For example, consider a virus/trojan like BUGBEAR or SOBIG, which deploy in stages and often communicate to various hard-coded web URLs for further instructions. All you need to do is create an IE ActiveX control (or script the actual iexplore.exe) and hide its window off-screen or something, and use it to do your http connections... the firewall will allow it through since it's under the context of the browser.

    It all basically boils down to the fact that 99% of people run windows as an administrator, barring corporate environments. If you have administrative privileges you can do just about everything (including adding/removing/starting/stopping services & NDIS adaptors, killing processes, etc.) so the virus might as well just disable the firewall rather than trying to work around it. And if you don't have admin rights, as long as the virus scanner has any kind of user interface that runs from a privileged account (remember that all services run as LOCALSYSTEM by default), you can use one of the Shatter vulnerabilities and gain instant admin access. A lot of people 'poopoo-ed' that vulnerability by saying "this requires local access to the box, and even then it just gives you local admin access" but that's exactly the scenario we're talking about here, and it's the perfect way for a virus/trojan to gain the privileges it needs to hide itself.

    I trust software firewalls about as far as I can throw them... that is to say, I don't.

  21. This also goes great with... on Repel Bugs With Your Cell Phone · · Score: 1

    This works very well in conjunction with those magnetic bracelets and anklets that increase your blood flow and heal your cancer, and those little magnets you put on your fuel line that give you a 300 m.p.g. carbuerator, and those cell phone antenna booster stickers to increase range, as well as that "airflow vortex" device that you put in your car's airfilter to create turbulence, and...

    (If by 'work' you mean separate a sucker from his money, of course.)

  22. Re:That's not what the story says... on Telemarketers Plan Counterattack · · Score: 3, Insightful

    Why would there be any question that the email would be spam? OF COURSE IT'S SPAM. If it's bulk and unsolicited, it's spam. Just because it's mainsleeze doesn't mean it's not spam. If Allstate sends unsolicited bulk email, they are just as guily as spamming as the asshat the sends you Make Penis Fast schemes. Don't ever get fooled into believing that "legitimate email marketing" is not a complete oxymoron. 99 times out of 100, when someone says "email marketing" they mean spam. The only bulk email advertising that's not spam is verified, closed-loop, confirmed opt-in mailing lists.

  23. Hey, it's relevent! on Mastering Regular Expressions · · Score: 1

    Here's where I take the opportunity to direct you to my homepage link above, where you will find a set of nasty regular expressions that you can plug into Privoxy, a filtering HTTP proxy. They will rewrite slashdot's HTML markup with CSS tags, which lets you create a stylesheet to modify the look and feel of slashdot quite radically. A fun distraction if you're bored...

  24. Re:The bottom line on Black Box in Speeder's Car Helped Conviction · · Score: 1
    and I doubt that the 98 mph was the speed at impact or the driver would almost certainly have died too.
    Well, it did say that the struck car's occupants died instantly which you would expect from such a speed. It also sounds like they were struck from the side, where there's much less protection and no airbag (unless it was an upscale late model car.) The speeder though would have hit head on and so had the full protection of all the front crumple zones and the front airbag.

    Plus, it seems to be some sort of law of nature that the probability of the at-fault driver dieing goes down as the heinousness of the fault rises. cf drunk drivers always surviving.
  25. Re:Did it to himself on Black Box in Speeder's Car Helped Conviction · · Score: 1
    First of all he LIED by saying he was doing 60MPH. Next, he was doing 114 (there is not a place in the US that allows that and in residential it's 25MPH). I'm sure the accident investigators would have been able to notice that he was well above 60MPH but even so, he lied and the black box said otherwise
    Give the guy a break... I mean, he was probably so drunk he didn't even remember where he was, let alone how fast he was going.