Slashdot Mirror


User: droleary

droleary's activity in the archive.

Stories
0
Comments
881
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 881

  1. Re:Exchange on Gates 'World's Most-Spammed Man' · · Score: 1

    Hmm.. 4,000,000 / 86400 (seconds in a day) = ~ 46 emails a second.

    Interestingly enough, according to this, that's right around his current dollars per second mark. I sure wouldn't mind getting $1 for every spam in my inbox.

  2. Re:Does it have any video games? on Neverland Theme Park Opens in Second Life · · Score: 1

    Are there any video games in Neverland? Then I can play a Video game in an Amusement park in a video game on my computer!

    Next step: Get an IT job at Six Flags so you can do all that in an amusement park!

  3. Re:Reminds of of an old AI story on Bill Gates Proclaims End of Passwords · · Score: 1

    It is a different approach from one-time-passwords, and I don't think either is better than the other universally. They're both reasonable ideas to approach the same problem.

    I think we agree more than we disagree. My biggest beef is with Billy, or anyone, touting smart cards as the be-all, end-all of security. They definitely have their uses, but they also have some very real weaknesses. From an "every day" standpoint, they are almost certainly better than most password policies most places have. But if it gets to the point that security is so unacceptable with user/password, I just think all appropriate solutions should be considered instead of just going for smart cards.

    I disagree with the assertion that all security is security through obscurity. It makes the expression meaningless, and its an important little catchphrase.

    It's only a catchy phrase, so it simply can't tell the whole story. The real issue is in what is obscured when protecting a secret. As you say, obscuring the algorithm is bad, but obscuring your password/phrase is, of course, good. Smaller secrets obscuring bigger secrets, as it were.

    There is a fundamental difference between an encrypted channel garage door opener and hiding a key under the doormat.

    Different isn't enough; we need to talk better. We both know that to do that requires knowledge of how each system is implemented to figure out the weakest vectors of attack. After all, finding my key under the doormat only gets you into my house, whereas finding an especially poorly implemented garage door opener system can get you into thousands of totally unsuspecting homes. Not to mention you have to target me to know I'm hiding a key, whereas a universal crack become something of a crime of opportunity (i.e., it might have been cracked for some other target and I'm hit afterwards just because I'm easy pickings).

  4. Re:Reminds of of an old AI story on Bill Gates Proclaims End of Passwords · · Score: 2, Interesting

    You love this phrase, "security through obscurity". I've never met a security expert who would consider dual private key challenge response encryption schemas security through obscurity

    That's funny, because I've never met an actual security expert who didn't understand that all security is based on obscurity (i.e., it's the very nature of keeping things secret). I guess we must know very different manner of experts, but I must say your talk doesn't instill me with confidence in yours being able to get the job done right. If it seems I use the "security through obscurity" phrase more than necessary, it's because it is a favorite on Slashdot and I'm not above pandering to the crowd. The key difference, though, is that the obscurity that people around here harp on is kind that leaves unintended access holes, not the kind that are understood imperfections.

    Deployed smartcard authentication systems are generally only vulnerable to key spoofing (which is a failure of the algorythm behind the authentication, NOT of the key storage mechanism) and vulnerable to physical decoding if the card is stolen, a point which even the PR guys in most smartcard vendors will stipulate. Are they perfect? No. But there exists no perfect security system in the IT world.

    Right, which is why you shouldn't be so aggressively trying to defend smart cards when in reality they offer little beyond what a manual one-time password offers, yet come with oh-so-many-more holes. It's like you're trying to argue that a fair algorithm is better than a shitty one-time pad, so people should stop using pads. That might be convincing to people without real secrets to protect, but I know bettter, and I'll take a fair one-time pad over any shitty smart card, and I have to assume it's shitty because the operation is usually completely black boxed.

    So let me rephrase what I said before - Given proper implementation, I KNOW its a level of security far above and beyond simple passwords.

    That is by no means a given, and that is why I consider your viewpoint to be so dangerous.

    But it is a battle-tested approach that's been very successful in deployment, and continues to be a favored system of authentication at the NSA and the Pentagon, two institutions who've spent quite a bit more brain cycles thinking about this problem then I'm sure you or I have.

    More importantly, they're the types of organizations that don't take anything as a given. If they use a smart card, you can damn well bet it is built to their specification. The rest of us are stuck with off-the-shelf stuff we really, really can't trust if we want to be honest about a system's security.

  5. Re:Reminds of of an old AI story on Bill Gates Proclaims End of Passwords · · Score: 1

    I think that's a level of secret protection far above and beyond simple passwords.

    And that's the danger. You think something you cannot audit gives you better protection. That is the very definition of security through obscurity. You don't realize it, but you're making my case for me. You seem to think knowing how a simple password is vulnerable is worse than not knowing how a smart card is vulnerable. That is laughably wrong. I really hope you're not in charge of keeping any system secure.

  6. Re:Reminds of of an old AI story on Bill Gates Proclaims End of Passwords · · Score: 1

    Any time you have secrets, its not security-through-obscurity. Security through obscurity is any time you try to make a secret out of something that is trivially discovered.

    But isn't that the case here? If I can social engineer a user to give me their password, adding a smart card into the mix is merely a type of obscurity. This is especially true for all the one-time authentication systems out there (i.e., you only have to validate once at login). While it's true that a smart card means you'll limit access to just that single session (or risk further social engineering attempts), the same level of secrecy can be had from any single-use password system. All the card provides is a way to keep the users from knowing their next password. I'm not even saying that kind of obscurity is a bad thing, just that it doesn't necessarily mean things are a lot more secure, anymore than it means that passwords are a think of the past.

  7. Reminds of of an old AI story on Bill Gates Proclaims End of Passwords · · Score: 5, Insightful

    A group of students are working on a neural net project. It comes time to decide what weight to put on the initial connections. One student says, "Set them all to 0 to start." Another student says, "No, that will introduce bias. We should set them all randomly." The smart professor replies, "You'll still have bias, only you won't know what it is."

    So to Mr. Gates I'd like to reply: You'll still have a password, only you won't know what it is. Makes sense from a "security through obscurity" standpoint, though! :-)

  8. Re:Base 10 bad idea? on Museum of the Future · · Score: 1

    Pointlessly abusive, eh?

    Yes, you were pointlessly abusive of those who use base 10. Oh, did you mean you're the one feeling hurt because you're being called an idiot for calling other people idiots? Dish it but can't take it, eh?

    The ability to conceptualize fractions like 1/3 and 3/4 long-predates the ability to deal with decimals.

    Would you also say it then pre-dates the ability to . . . wait for it . . . tell time?

    The first place that everyone learned fractions was looking at an old analog clock. It transfers to something you can use every day with ease, and moves those concepts into your brain at a very young age.

    I see you indeed are being deliberately dense. There are any number of "every day" uses for integer division. It's totally moot, because that is merely one type of division and how you represent that special case should in no way serve as a framework for all math. I'm frankly surprised to see such ignorance displayed on Slashdot by someone with a relatively low UID.

    If you ask your kid what time it will be 33.3333333 minutes after the hour that has two disadvantages.

    I assume you mean for an hour that consists of 100 minutes, which translates to currently asking a kid what time it will be 20 minutes after the hour. I'm sure he'll respond that it's 20 minutes after the hour (or 33 1/3 in the "evil metric time future"; oh, see how I can still use a fraction? :-)

    First of all they are learning decimal not fractions. Fractions aid visualization, decimals don't.

    If they just have to parrot back the number they give them, they aren't really learning much of anything, are they? But, seriously, what about getting a third in any base is hard? If a kid can divide 60 by 3, they can damn well divide 100 by 3 and then go on to represent it any way they want. I'm not buying your "visualization" argument, either, because it begs the question by assuming a particular clock face. You could still just as easily produce a clock that had 100 minutes using the current divisions and, guess what, it'll still be a third of an hour when the big hand is on the 4 (though it would make more sense labeled "1/3", which totally blows your argument out of the water). Decimal notation in no way impacts how you deal with a fractional hour. It merely changes the representation from something like 4:20 to 3.33.

    Aaw, why am I bothering. You're pretty obviously a decendant of the base-10 tribe and won't get it no matter how long I go on.

    No, I am obvious a person with no particular affinity to any particular base or representation. For some reason your mind is stuck on the notion that a base having a lot of small integer divisors is somehow special. It's not. Even binary will do the job. If anything, technological advances have shown that a base having fewer integer divisors makes the math easier to do. I'll match my base 2 computer against your base 12 computer any day of the week. You're right in thinking I won't "get" your point of view if you kept droning on; I have no desire to be as mind-bogglingly wrong as you are.

  9. Re:Base 10 bad idea? on Museum of the Future · · Score: 1

    Isn't the whole point of metric to make simple calculations easier? Wouldn't base 12 have helped that?

    I think the answer is "no" on both counts. The two main advantages of metric (i.e., SI units as derived from cgs) that I can easily point to is that it 1) standardizes relationships between different units and 2) uses a common notation for orders of magnitude. I don't see how base is a particularly important factor in that.

    Where I live we've got an 8.3 percent sales tax...which is almost exactly 1/12th of a dollar!

    So what? How does that help you in any way? I have a 6.5% tax. How would your base 12 help me in any way? As a geek I can work reasonably well in a number of different bases, and to me all a fascination with base 12 means is that your mind is stuck on integers.

  10. Re:Base 10 bad idea? on Museum of the Future · · Score: 1

    As I understand it . . .

    You clearly don't understand much. There is nothing particular smart or stupid about a particular number base; rather it's a question of utility. The utility of base 12 in having a number of factors is only for systems limited to integer math with small numbers. In that respect, it is the "stupid" choice.

    Anyway, a base 10 clock would be lousy. The quarter hours are gone, the only division is the half hour. You also lose the rarely used ability to divide the hour into thirds easily.

    Are you being deliberately dense? The divisions you find so handy are completely arbitrary and are a chicken-and-egg issue. They can also be expressed in decimal. Hell, they can be expressed in binary, and you'd look like just as much a fool on Slashdot if you started moaning about base 2 being that much more limited because it's not even divisible by 5!

  11. Re:What the system should do... on Automatic Scanning for Cameras in Theaters · · Score: 1

    "The person now being brightly lit is the one responsible for ruining your viewing of tonight's feature presentation"

    No, the person ruining the movie is the theatre employee who activates the system. The person recording the movie can easily do so without disturbing everyone else. Hell, the very nature of what they're doing relies on them not cheesing off other movie goers. Any theatre that stops a movie I paid for to be a bullshit MPAA policeman only means I'm going to get a refund and that I'll be less likely to go there in the future.

  12. Re:best way to deal with this on Best Buy: 20% Of Customers Are Wrong · · Score: 3, Funny

    I've been to a best buy that wouldn't take cash unless I provided a picture ID.

    Just hold up the $20 bill (or whatever) in front of your face and say, "Hi, I'm Andrew Jackson and I'm legal tender for all debts, public and private!"

  13. Re:Would it state... on Skype Founder Interviewed On Engadget · · Score: 1

    But doesn't the fact that they specifically state they do not have spyware give people the ability to sue them for false advertising if they do have spyware?

    Nope. It's just like spam, where the spammer's definition is "that terrible kind of email we don't send".

  14. Re:fp on Music Downloading not Entirely to Blame · · Score: 1

    It could also suggest that you no longer are interested in stuff that you don't like right away. Looking back at all my CDs, I find that it is very common for my favorite tracks to be ones that I initially did not think much of. They grew on my after many listens, as I came to appreciate things I hadn't noticed on the first listen.

    Perhaps that just suggests that you haven't (yet) developed any real muscial tastes. It's kind of hard to say that without sounding insulting or like flamebait, but some of us can know pretty well at first blush if a song has legs or is just garbage. If you're not noticing that kind of thing right off the bat, then your "first listen" is probably being done at a more casual than critical level. There's nothing wrong with that, but don't poo-poo the guy who actually sits down to grok a track (or entire CD) and finds it wanting. If you're the one who has initially missed spotting your eventual favorite track, it says more about your listening habits than it says about the person you're responding to.

  15. Ob. Simpsons on A Review of "The Incredibles" · · Score: 1

    I really enjoyed this movie, but it had a weird streak of Ayn Randism running through it. I actually rather liked that, but each time it caused to step back from the movie a little bit. There were a couple of lines thrown in like "And when everybody's super, then no one is," announced by the bad guy. Or when Dash is told by his parents that everyone is special, he retorts with "that's just a way of saying that nobody is."

    Is that Ayn Rand, or is that simple logic? It reminds me of a pet peeve I have over people saying "It's all good". Well, then it's all bad, too, because you're just saying it's all the damn same!

    Bart: "Nothing you say can upset us. We're the MTV generation."
    Lisa: "We feel neither highs nor lows."
    Homer: "Really? What's it like?"
    Lisa [shrugging]: "Ehh."

  16. Re:my guide to avoiding worms on Using Layered Defenses to Stop Internet Worms · · Score: 2, Insightful

    I know this was meant to be funny, but I think it is this type of thinking that could one day lead to other operating systems being exploited or filled with worms as much as Windows is now.

    Get back to us when "one day" comes, then. Like the people who play the "Windows marketshare ensures it is the most exploited" game, your logic is flawed. Alternatives to Windows all start from a different base and evolve in a different manner, so you can't assume that what trouble 95% of users today will necessarily trouble 95% of users in a mythical Unix-ubiquitious future.

    If someone honestly thinks that simply running an operating system other than Windows will keep them safe, then I fear the future will be much dimmer.

    Your fear is a baseless phobia. The truth today is that, yes, simply running an OS other than Windows will keep them safer. I realize that there is no guarantees for the future, but for today I would get my mom a Mac and fret very little even if she never did a software update unless I was there, whereas I know she'd be bombarded by malware every day if I pushed Windows on her.

  17. Re:Story = Engadget Plug on How to Get Music Off Your iPod · · Score: 1

    again, when i hit submit i have no control over what gets changed before it goes live, i don't think a single one has ever been what i sent exactly. each time and every time i do my best to make it clear who i am and that we wrote the article (engadget).

    You are a liar. I give specific examples that contradict your statement. You further engage in lies of omission by never directly saying what Slashdot did or did not change. The only reason you have to dance around the issue is if you actually wrote those phrases, and intended from the beginning to be deceptive.

    i don't think it's fair to blame /. for edits, adding links or removing stuff, they have a voice to maintain.

    You're right. Slashdot is not to blame. You are to blame. You are scum.

    since there are a couple people who care (most posting here) isn't it obvious if i was trying to fool anyone, i'd just send them as someone else?

    I already addressed that. Did you even read my post before responding to it. You're simply a bad astroturfer, and it's entirely too late to save Engadget's reputation.

    from the start, i've always been me and always do my best to make it clear who i am, and who i write for.

    Continually repeating a lie does not make it true. The most recent article you submitted astroturfing for Engadget saying "they" was just in late September. From the start and into the future, your lies will ruin you and those who associate with you.

    i'm not sure what else i can say to satisfy you.

    You could have done specifically what I asked you to do. You did not, so the only conclusion I can come to is that Slashdot did not in any way act to edit your submission so as to imply there is no relationship between you and Engadget. You are responsible for the misrepresentation, and the fact that you are unwilling to own up to it makes you all the more disgusting.

  18. Re:Story = Engadget Plug on How to Get Music Off Your iPod · · Score: 1

    the editors changed what i sent as they usually do, all the better i might add. i don't think it was misleading, they linked to engadget "we" which i am glad they kept, linked to the article and added more links.

    Again, lies of omission. It's isn't just about how cleverly you can word new articles, but what you wrote in the past and whether or not those were edited to distance you as the submitter from Engadget or if you are a scummy astroturfer and wrote those phrases yourself. You can't talk your way past the record like some slick politician. In recent history I see:

    • ". . . Engadget shows how they did it . . ."
    • ". . . Engadget shows how they made . . ."
    • ". . . The folks over at Engadget made . . ."
    • ". . . Engadget's weekly how-to article . . . Their example they show . . ."

    Either you can directly state right now you originally submitted them without trying to hide your association (e.g., "at Engadget we show how we") and only then can you pin changes on the editors and Slashdot, or you've got a dirty site. Someone takes the blame for that pattern of articles: Slashdot or Engadget.

    most people who want to plug a site would use another name, pretend to be someone else, i always state who i am and that we wrote the article.

    No, I think you weren't expecting people on Slashdot to put 2 and 2 together so fast. Now that everyone is aware of the astroturfing, you pretty much have to make all future submissions be from a known associate because anyone else doing an Engadget submission just makes you look even more suspect.

  19. Re:Story = Engadget Plug on How to Get Music Off Your iPod · · Score: 1

    keep in mind, 99.999% of the time when i submit a story on /. someone edits it before it goes live. this post about getting content off your ipod isn't exactly what i submitted either. usually it's edited, links added or removed and then posted.

    Keep in mind that your are committing a lie of omission by say things can be changed, but never once state directly that the editors did change your submission in such a way as to remove or obscure reference to Engadget. If you can't say directly that the editors are responsible for the misleading articles, then you are the one running your site with questionable ethics. All you need to do to clear your name is to make a direct statement that fingers Slashdot instead. I'm waiting.

  20. Re:Laurels? on DoubleClick On The Blocks? · · Score: 1

    According to my ruler, we'd need to beat them to within 2.54 centimeters of their lives.

    According to my ruler, we get to beat them an extra 1.54 centimeters.

  21. Re:Why No Mac Support? on Ask City of Heroes Lead Designer Jack Emmert · · Score: 1

    Tron 2.0 uses OpenGL. City of Heroes uses DirectX 9. You figure it out.

    I think he did figure it out, which is why he's asking the Lead Designer why they developed a non-portable game when the state of OpenGL clearly allows you to maximize your profits by porting to Mac OS X or Linux or any supported platform. So it's disguised as a question of Mac support, but it really could be phrased as "What do you find OpenGL (and other portable libraries) lacking such that you have restricted your awesome game to a Windows-only audience?"

  22. Re:*Yawn*... on Coating Promises Scratch-Proof CDs, DVDs, LCDs · · Score: 1

    Call me when they have a transparent industrial diamond coating. Until then, don't call it "scratch-proof."

    Yeah! And it better play OGG, too!

  23. Re:Laurels? on DoubleClick On The Blocks? · · Score: 4, Funny

    Need to be taken out back of the Interweb and beaten to within an inch of their lives.

    On this issue, I think we can all get behind the metric system and beat them within a centimeter of their lives.

  24. Re:Riddle me this Strawman: on We Pledge Allegiance to the Penguin · · Score: 1

    With them, you get something, an infinite percent improvement.

    That kind of thinking and a dollar buys you a lottery ticket.

  25. Re:Just the name brings back memories on Cray XT-3 Ships · · Score: 2, Funny

    There are two prominent applications for these machines. The first is nuclear weapons simulation. Personally, I don't see the point to that.

    Well, when you nuke the site from orbit, you do want to be sure don't you?