Slashdot Mirror


User: Simon+Brooke

Simon+Brooke's activity in the archive.

Stories
0
Comments
1,603
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 1,603

  1. Re:PGP on How Would You Prefer To Send Sensitive Data? · · Score: 0

    > > I would only ever send sensitive data via PGP-encrypted and -signed email, or more specifically via PGP-encrypted and -signed attachment to an email > none of these help if some determined individual intercepts the traffic and has the resources to brute-force the encryption Um... yeah, right. Do you know of any individual, group, company, government, species, or universe with such resources?

    Yes. The Russian mafia. They have much more than sufficient resource - not merely access to supercomputers, but also access to large botnets of other people's PCs. Cracking encryption is a task well suited to distributed computing.

    Yes, these people can and routinely do crack military grade encryption, if the data is valuable enough. This data is valuable enough.

  2. Re:PGP on How Would You Prefer To Send Sensitive Data? · · Score: 4, Insightful

    VPN *AND* scp? weirdo.

    Not in the least. What guarantee do you have that there isn't an attacker already in your network, or the recipients network? Split into small chunks first. Encrypt with separate keys, then SCP over VPN.

  3. Re:PGP on How Would You Prefer To Send Sensitive Data? · · Score: 2, Insightful

    has the resources to brute-force the encryption
    If you're using PGP, such resources simply don't exist.

    You are being awfully naive here. Personal details are worth about US$50 each to identity fraud gangs. 10,000 personal details times US$50 is half a million bucks, and that buys a lot of supercomputer time. Any encryption can be brute forced given enough brute force.

  4. Re:PGP on How Would You Prefer To Send Sensitive Data? · · Score: 4, Informative

    Correction: ftp://10.10.10.10/yourfile.csv is the proper example link.

    You do not want to use FTP at all. FTP is a very insecure protocol. If the data is very confidential, then you need to secure it against

    • An attacker pretending to be the designated recipient
    • An attacker capturing the stream in flight
      • Where that attacker is within your network
      • Where that attacker is within the recipient's network
      • Where that attacker is between your network and the recipients

    Remember no encryption is so good that it can't be cracked, given sufficient compute power and sufficient time, and that the profits from identity fraud are now sufficient to make it worth criminal gangs while to put significant resource into cracking encryption.

    So to send this data, in my opinion, you need to split it into chunks which are in themselves of low value (i.e. first file, names and employee numbers; in the second file, social security numbers and employee numbers; in the third file, addresses and employee numbers; in the fourth file, ages and social security numbers; and so on); encrypt these chunks using different encryption keys, so that decrypting one will not provide the key to encrypting the next; and send them over a secure channel.

    The UK Government has had a series of scandals recently where couriered media (CD-ROM disks) with valuable personal information has gone missing, so couriering this is not a good plan. Criminal gangs are apparently now willing to pay about US$50 per person for identity details like these, so in terms of value for unit mass, a CD with these details is worth much more than diamonds.

  5. The question is not whether lunar rights are good on The Case for Lunar Property Rights · · Score: 3, Insightful

    The question is not whether lunar rights are good, but whether any 'property' rights in land are. The arguments against property in land are strong. When someone creates something - adds value to raw material - it's reasonable that that person should have strong rights to the object created; they've put the work in. No-one (except the Dutch) creates land. People argue that 'improving' land gives the improver the right to it, but

    • There is no change that people make to land which is unequivocally an improvement; and
    • The value of the improvement is never a significant proportion of the value of the underlying land.

    Property rights in land all date back ultimately to theft: through the appropriation of a resource which was common to the whole community, and making it private to one individual. Mostly, that theft has been accomplished with the aid of serious violence, often genocide. It's a basic principle of the rule of law that you can never have good title to stolen property; so you can never have good title to land.

    Property in land creates persistent inequity in societies over generations, leading to highly stratified class systems and drastically reduced social mobility. It creates kakocratic societies, which reward the most dishonest and dishonourable; and it prevents communities from making efficient planning choices about their lands.

    Extending what has done such drastic harm to the Earth to other planets is the opposite of good sense.

  6. Horses for courses on Do Static Source Code Analysis Tools Really Work? · · Score: 1

    Yes, they kind-of work; it depends what you're doing and what you're trying to achieve.

    Example: recently I was doing a quality audit of a bit of code which ran an industrial control unit in a safety critical application. The software was written using an obsolete, closed source C compiler and the processor was an old Hitachi; there is a GNU C compiler for it but because the code was non-ANSI we couldn't use that (the object was to audit the existing code for safety, not to change it). So dynamic analysis of the running code, other than black box testing of the complete controller, was not possible.

    My job was to demonstrate that the code could not fail unsafe. I used QA/C, which I found very useful, and VectorCast, which turned out not to be useful on this particular project because it needs to interact with the compiler. The compiler would only run under 16 bit DOS, VectorCast under 32 bit Linux or Windows, so it proved to be impossible to get them to communicate (this doesn't mean VectorCast wouldn't be useful on other projects).

    In summary, you wouldn't want these to be the only tools in your audit toolbox. But to get to understand a piece of not-very-well structured legacy code quickly, they're pretty useful.

  7. Re:virtual 3d office (no - not "virtual 3d desktop on Most Business-Launched Virtual Worlds Fail · · Score: 3, Interesting

    the most practical way to make a virtual world actually "useful" is to make a virtual office.

    My employers will sell you this. Indeed, they'll be delighted to sell you this, since we developed it three years ago and so far have no real customers. It's a great idea... on paper.

  8. Re:Attention on deck! on Most Business-Launched Virtual Worlds Fail · · Score: 1

    Cringely is frequently wrong, but always for interesting reasons. One of the few talking heads (typing fingers?) out there who seem to process what they take in rather than reframe what they read. You would do well to emulate this behavior.

    I'd read the Cringely article before I got to this thread. Yes, Cringely is sometimes wrong. But he's not wrong about Gartner (or Aberdeen Group, or other such-like 'research companies'). Of course, the fact that they mostly spout rubbish doesn't necessarily mean that they're wrong in this report, which I haven't read.

  9. Re:Web Places & Pages on Most Business-Launched Virtual Worlds Fail · · Score: 1

    The problem with "web places" is that no one has quite mastered how to "hang" at web places without spending first tier time at a computer. As a few SF books have shown, web places will take off when you can visit for 17 minutes in the line at a restaurant.

    It's called a 'smart phone'. They will be invented in about the year 2000. Furthermore I predict that a well-known upmarket vendor of digital appliances will come out with a very elegant one in about the year 2007, and that it will rapidly become popular.

    Great, this predictions business!

  10. Sugar on Microsoft and OLPC Agree To Put XP On the XO Laptop · · Score: 2, Interesting

    It is a huge shame that the OLPC project has deteriorated in this way. When first announced,I was really keen on getting hold of one of these machines to see what I could do to help. I downloaded the .iso of the Sugar GUI and ran it in a VM - very clunky in the VM, but you could see the potential. Others I demonstrated it to were equally impressed. Now it seems to be floundering desperately and the Microsoft sharks are closing in for the kill.

    Strongly agree. I think Sugar had - has - the potential to be the next big thing in user interface. It's a complete new look at how the graphical user interface works, and in my opinion it looks streets ahead of the conventional WIMP interfaces we're using now.

    Of course, Sugar is a project which is, at least potentially, independent of OLPC. I really hope that enough of a community will carry on developing Sugar to make it a viable alternative desktop, not just for third world children, but for all of us.

  11. Re:Well... on Einstein Letter Goes on Sale · · Score: 4, Interesting

    Iesu ben Iussuf, a carpenter's son from Nazareth who became a radical rabbi, probably existed. There's no contemporary documentary evidence, but there is plenty of evidence of radical Jewish religious movements about the same time and the later emergence of Christianity is reasonable corroboration. However, whether or not Iesu ben Iussuf existed casts precisely no light whatever on whether God exists.

  12. Re:Well... on Einstein Letter Goes on Sale · · Score: 2, Insightful

    Why am I bothering to reply to something so obviously foolish....?

    Physics is the study of the physical universe. God, as an entity, doesn't exist in it. Either

    • there is nothing which exists outside the physical universe;
    • or else anything which exists outside the physical universe cannot interact in any way with anything which exists within it.
    • Personally I'm quite happy to accept that God is a real emergent property of human politics, and that, in that sense, God exists. By creating a God and persuading other people to believe in it you can extend hegemony over them, increasing your own political power; and people have done that for millenia. But if you want to argue that God created man, and not the other way around, then sorry, but you're out of your tree. It is not merely not rational; it is not possible.

  13. Re:too little, too late? on Mono's WinForms 2.0 Implementation Completed · · Score: 4, Insightful

    Java is fast? Go try to run Azureus and weep.

    Oh, you do? And you think it is fast? Try utorrent on Windows or Transmission on OSX or KTorrent on Linux some time.

    People can write slow programs in any language. The question is, can moderately competent programmers write fast, efficient, maintainable programs in them? Pointing to one example is pointless. Back on topic, a quick check on Alioth will show you that overall, Java is faster than C#/Mono but uses more memory (although on some benchmarks the opposite is the case). It's also worth pointing out that although Java is not faster than C++ on any benchmark, it's substantially slower on only three. In general the performance of a program has much more to do with good design and good algorithms than it has to do with choice of language.

  14. Re:Heart ? on Earthquake In China · · Score: 1

    You guys have been the reason possibly more than 300000 people were killed in Iraq The number is closer to a million since it all began, but to be honest Saddam and his sons had a fair bit of blood on their hands as well. http://en.wikipedia.org/wiki/Casualties_of_the_Iraq_War

    It's worth pointing out that Saddam came to power as largely an American puppet, and as late as nineteen ninety the US govenrnment (and the delightful Mr Rumsfeldt) were still selling him chemical weapons. Furthermore, of course, the first person to use chemical weapons on Iraqi civilians was Bomber Harris, the well known British war criminal (err, sorry, I mistyped 'hero').

    So I think you can trace Western responsibility for the troubles of Iraq back far further than the last ten years.

  15. Re:Heart ? on Earthquake In China · · Score: 2, Insightful

    OK, so this is a flamefest and I'll pitch in

    Chinese people - Han Chinese - get taught in their schools that Tibet has been part of China from way back. This may be true or it may not, I don't know. But during the late nineteenth century and up until 1958, it was not effectively true; Tibet was effectively autonomous. Furthermore, the fact that somewhere used to be 'part of' some state is no argument that it should continue to be. Half of France used to be part of England. What is now the Republic of Ireland used to be part of the United Kingdom. But the majority of the people of Ireland didn't want to be part of the United Kingdom, and so they're not now. That's how it goes.

    Scotland is currently part of the United Kingdom, and nationalists - like me - want it to be independent. So we're campaigning for a referendum on independence, and sooner or later we'll get one. And if we're outvoted, we'll lose it; that's how it goes.

    Nor does the Chinese argument that the theocratic government of pre-1958 Tibet was a 'bad' government wash. Yes, it wasn't democratic. Yes, it was essentially feudal. But the current Chinese administration isn't exactly in a place to throw stones.

    However, where it gets tricky is this: there's a distinction between people who have been indigenous to a place for generations, and new immigrants. There are now a lot of people in Tibet who aren't indigenous to Tibet (same's true here in Scotland). It isn't their fault that they're there. And they have, it seems to me, as much right to have a say in the future administration of the place as everyone else there. So if Tibet could have a referendum on independence (which I believe they have a right to), the 'indigenous' people might not win because they might be outvoted by new immigrants.

    I feel a lot of sympathy for the ethnic Tibetans, who are, I believe, having a raw deal. But I don't think that excuses the sort of race riots we saw earlier this year, where Han Chinese immigrants were attacked just because of their race.

  16. Re:A rare topic on What Is the Oldest Code Written Still Running? · · Score: 1

    Most computers made for Windows 95 wouldn't run as well even with an ultra-minimalistic Linux distros at the same level as Windows 95 Where are you getting your info from? I'm not going to disagree as I've never tried such a comparison myself, but it sounds more than a little farfetched.

    You're not going to disagree? Heck, I am. The first machine I ran Linux on was an 80386sx25 with 4 Mb of RAM. Linux ran fine and X-Windows ran fine. I agree you couldn't run either KDE or Firefox on that platform, but two years later I was doing serious development on a 80386dx100 with 64Mb of RAM, with Netscape Navigator as the browser and the excellent Asterisk office suite for my word-processing and spreadsheet needs (I also had WordPerfect, but didn't like that so much).

    Linux always ran better than Windows on lower spec machines, right back from Windows 3.1 days

  17. Re:The real question here is... on Peter Gabriel's Web Server Stolen · · Score: 1

    I heard the crime was committed by an Intruder.

    Intruder cable duct, I presume, since these buildings typically don't have windows...

  18. Re:correction.. on The Continuing War Against Microsoft's "Facts" Campaign · · Score: 2, Informative

    NOT NOT is null. NOT NOT Var is Var. :. NOT NOT True == True is true.

    In some particular programming language, perhaps.

    More generally, however, the GPP is correct.

    In first order predicate calculus, and also in propositional calculi, and at least half a dozen other logical formalisms, a negated negation is an assertion. It's called 'principium tertii exclusi' and is present in most western logics (although, interestingly, not in many classical bhuddist logics).

  19. Re:Contradiction=bad things on SCO's McBride Testifies "Linux Is a copy of UNIX" · · Score: 1

    Darl was on the stand under oath. Lying in such a circumstance is a crime, known as perjury. HTH, HAND.

    --

    Don't feed the trolls - when an AC says something stupid, let it slide.

    Irony. Like coppery or silvery, only harder.

  20. Re:This should be good on SCO's McBride Testifies "Linux Is a copy of UNIX" · · Score: 5, Informative

    You're right. It isn't. It is, however, Unix-like. And intended to be POSIX compliant. And an awful lot of Unix utilities and abilities have found their way into Linux, starting with the System V-compatible init. X, BASH (and its variants)... you could go on for hours listing programs and commands that have found their way into Linux from the Unix world. Perhaps the most obvious example aside from BASH would be XFCE, which models its interface after the CDE.

    <sigh/>

    You expect Slashdot readers to be tech literate, but sadly they ain't. Not these days anyway.

    'Linux' is a kernel. Both in fact and in the context of this court case, that's all 'Linux' is. Bash is not part of Linux. Init is not part of Linux. They are programs which can run on top of Linux (or any other POSIX compliant operating system, including UNIX).

    Yes, I know we've all got lazy and refer to Ubuntu and Debian and Slackware and RedHat as 'Linux', but they aren't. They are software distributions which use the Linux kernel. The kernel - and only the kernel - is 'Linux'.

  21. Re:dumb, ill-informed sarcasm on Falling Microsoft Income Endangers Yahoo Bid · · Score: 2, Funny

    Why do you have to drag this bullshit sarcasm into this discussion? [scythe] So, stop that stupid sarcasm and get some of the facts, OK?

    Because, outside the US of A, there are still some people who understand humour. Inside the US of A, of course, you can't even spell it.

  22. Re:It's JS on ExtJS 2.1 AJAX Library Switches To GPL · · Score: 2, Insightful

    I know. I was just trying to start a discussion about the inherrent openess of Javascript, and to remind everyone that when you do program in Javascript, that the source is out there for everyone to see.

    No, it isn't. If you do something which is

    1. client side, and
    2. on a public website, and
    3. not protected by any user authentication

    then it the source is out there for anyone to see. Otherwise, not.

    Open source means different things to different people.

    CastrTroy (595695), meet Humpty Dumpty. He's been hegemonising language for much longer than you have, and knows rather more about how to do it.

  23. Re:The crux of the exploit: on NULL Pointer Exploit Excites Researchers · · Score: 1

    That is just silly, and demonstrates a lack of understanding of programming. High level langauges with built in checks and safties are very useful in a lot of situations, but they do not meet the needs when precision and control of the underlaying hardware is required. Whether flash needs this level of control I do not know, but plenty of applications do.

    Furthermore, if you ban the low level languages, what are you going to write the high level language's byte-code interpreters in? You generally need a bit of low level stuff to bootstrap your virtual machine.

  24. Re:Big deal on NULL Pointer Exploit Excites Researchers · · Score: 4, Informative

    I don't think I'll be updating adobe on my linux box just yet. sudo apt-get update; sudo apt-get upgrade

    solves the problems on Ubuntu boxes as of this moment, so someone at Ubuntu is paying attention. Don't know about Debian, because I don't run Flash on any of my Debian machines.

  25. Re:Why would they even bother? on Linus Announces the 2.6.25 Linux Kernel · · Score: 1

    To a large degree Linux needs elitist geeks, their what makes it tick. But at the same time we speak of "The Year of the Linux Desktop", which leads me to believe that some subset of these elitist geeks want their pet OS to be adopted by the masses. Being elitist geeks is at good for Linux as a project, but bad for Linux as a pay OS alternative.

    I think the 'we' who speak of 'the year of the Linux desktop' is a different 'we' than the 'we' who actually build free software (and, for the record, I don't any more as my contract of employment prevents me). The people who speak of 'the year of the Linux desktop' are mostly - not entirely - journalists and media pundits. The people who build free software mostly - not entirely - don't care.

    There needs to be some balance. I would be doubtful, but I have been wrong about these things before. I always thought that Linux devs couldn't make a good GUI to save their lives, but I'm slowly being proven wrong (not 100% yet, but 60% is better than 0%) by Ubuntu, and the KDE and Gnome teams.

    If you want a user friendly operating system, and you don't have the skills to do it yourself, Steve Jobs or Bill Gates will be perfectly happy to take your money and sell you one. And that's perfectly OK, if that's what you want. This is where we're going to disagree. I always saw Linux and the OSS community as somewhat an ethical stance as well. The MS and Apple's of the world are not good for OS development, and are guilty of some ethically wonkey actions. To combat this Linux must be viable enough to change their practices (i.e. a threat).

    OK, I partly agree. MS in particular and Apple to a lesser extent are driven by motives which are, in the end, inimical to the interests of users. Basically both want to lock in their users and turn them into perpetual sources of repeat revenue. There is an ethical case for providing an alternative that breaks monopoly power and gives users choice. But I don't think that Linux - at least in it's present development model - either is or can be that alternative.

    Why not? Linux is build by geeks for geeks. The needs that a geek has of an operating system are different from the needs a non-computer-literate user has of an operating system, and I think it would be difficult to the point of impossible to design one user environment which suited both. But if you design a user interface which suits the ordinary user and doesn't suit the geeks, the geeks won't use it so it won't cause them itches so they won't maintain it... so it will die.

    I think that is inevitable. I think it is in the nature of the software ecosystem. I'd like to be wrong, but I don't think I am. I think if you want a 'user friendly' - to mom and pop users - user environment, someone is going to have to pay to build it, and to pay to maintain it.