Slashdot Mirror


User: CokeJunky

CokeJunky's activity in the archive.

Stories
0
Comments
140
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 140

  1. Short Short version on Critical VMware Vulnerability, Exploit Released · · Score: 1

    If you run one of the affected VMWare products, and have host folder sharing enabled, and run either a piece of software or a trojan horse virtual machine(i.e. that you downloaded or otherwise shared) with exploit code in in it, then that software can access your host machine with elavated privledges to at the very least the same as the logged in user on the host machine, and possibly to the administrator level.

    Essentially what it says is that the vmware host folder sharing mechanism does not properly limit access to the host machine to the mapped folders -- tricks in how MCBS-Unicode conversions take place allow a carefully encoded path to include ..'s in it that are not filtered out or caught by vmware, and therefore access anywhere on the host machine with the same privledges as the VMware host software.

    Workaround: Disable host folder sharing, and be careful about how much you trust shared VM's and software running on a VM image you build yourself.

  2. The problem is not finding them... on How Do You Find Programming Superstars? · · Score: 1

    It's validating their claims. The only way to really prove someone is a superstar is to audition them -- actually have them do some work, when another superstar (or at least another programmer who knows the difference between a superstar and a regular grade B programmer) work with them, and figure it out.

    Besides, what makes a superstar? It's not just pure brilliance -- they have to be able to be flexible, integrate quickly with a team, and properly document and share their ideas without treating their colleagues like children.

    Back when I still thought I wanted to write video games for a living, there was a great book on the topic of designing and marketing games. Well, a humorous book, anyways. It discussed the problem of working with Prima-Dona programmers, and ways to get them to work on the team. My favorite anecdote described a programmer who was excellent, but worked in such a way to ensure that they were irreplaceable. So, what that company did is hire another programmer, who was relatively young and willing to play the part, and gave the irreplaceable guy a 'promotion' and an 'assistant'. The assistant's real job was to get a handle on the internals of what the other guy was doing, and document it. After a few months, the assistant gained the trust of the prima-dona, and figured out everything, and then presented his new documented, highly professional replacement component, and the prima-dona programmer was given a chance to shape up or ship out... I don't remember the exact outcome, but I enjoyed the story.

    The point is that it is highly subjective, and dependent on the environment to find someone like that.

    I know I would rather have a solid hard-worker who isn't necessary brilliant, but is good, and has a likable personality and good attitude towards work and the company/team, than an impossible genius any day.

  3. Why were those studies unpublished? on Antidepressants Work No Better Than a Placebo · · Score: 1

    Studies don't get published for a number of reasons. Perhaps they were quashed by the pharmaceutical interests, but perhaps they were not published because they were poorly run, suffered from an experimental bias, because they failed to actually demonstrate anything, or because they would never pass the scrutiny of peer review.

    And, who funded this meta analysis? What biases do they have? There are a variety of groups that are morally or religiously opposed to psycho-pharmaceuticals, and many of those are no more hesitant than the pharmaceutical interests to manipulate data and the scientific publishing process to support their view.

      (a meta-analysis is where instead of doing lab work, someone tries to assemble some literature on the issue, and plays with the numbers to make it work together, even though the original studies are often performed in very different ways and looking at very different results.)

    Long story short? Big grain of salt recommended.

  4. Obviousness on Multitouch Gesture Patents Could Prevent Standardization · · Score: 2, Insightful

    I wonder if there is any chance that these patents could fail on the basis of obviousness.

    I figure that the better the gestures are for doing specific tasks, the more obvious they should be. I don't have a problem with patents on the technology behind the touch and multi-touch sensors, but I have to say that it would be a bad idea to use patents to prevent people from moving their hands in a particular way. Otherwise, you might get in the situation where you have a multi-touch sensor on a computer, but only the licensee of the software is allowed to use those gestures.

  5. What happens in a collision? on 100-MPG Air-Powered Car Headed To US Next Year · · Score: 1

    High pressure air is dangerous -- what happens in a collision? With a gas or diesel engine, with modern fuel tanks, there is the chance of a fuel leak, but even if that happens, there is no guarentee it will ignite -- cars don't tend to blow up like in the movies.

    On the other hand, a ruptured high-pressure air tank will (depending on it's design and the nature of the collision) either turn into a projectile, or else blow out shrapnel with considerable force. I am interested to hear about how these do in crash tests! Granted, this is most likely a solveable engineering problem, but still, it needs consideration. The good news is that in a collision, if the tank is breached, at least you wont be charged an environmental cleanup fee for leaked fuel! In my city I think you get a bill for around $600 to $1000 that is not usually covered by insurance.

  6. It seems to me that the Nasa Vets are off-topic on NASA Vets & Administration Clash Over Moon Plans · · Score: 4, Insightful

    I was always under the impression that the moonbase plan was not really a hopscotch for going to mars physically, but rather a proving ground to test, develop, and prove that it is feasible to set up permanent installations on other planetary bodies. If something goes wrong in a moon mission (i.e. that Apollo mission), it's only three days away, and there is at least a chance of bringing people back home. A screw up on a year-plus mission is more certain death.

    I couldn't imagine trying to do something like that on an asteroid or going straight to mars until we have figured out how to get to the moon, and stay there for a while!

  7. Collusion? on Jack Thompson Claiming Games Industry in Collusion with DoD · · Score: 1

    Try competition -- seems to me the DOD is writing their own games in competition with commercial manufacturers.

    What a nut.

  8. Why do books still have chapters? on Why Do Games Still Have Levels? · · Score: 1

    Why do movies and plays still get written in acts and scenes? Why do television commercials come on just when something interesting is happening?

    The answer is that that it is a classic story telling technique. Some (books/movies/plays/tvshows) have successfully done without, and more power to them.

    Now that the technology doesn't need so much time to catch up to the player, the game designers and story tellers out there can concentrate on using it purely as a story telling technique, and not as a crutch to support technology.

    Cutscenes and levels are just another tool on the utility belt of game designers. Those tools do not need to be ignored, but just as a carpenter is able to smack his thumb with a hammer, the question is how will game devs/designers use them?

  9. At least.. on Jack Thompson Sends Subpoena to Bush · · Score: 4, Insightful

    he can claim that gaming has driven at least one person to raving lunacy... Himself! (at least in my personal opinion.)

  10. The traditional (and legally strong way).. on How Do I Secure An IP, While Leaving Options Open? · · Score: 0, Redundant

    Is to send a copy to yourself or someone you trust by registered mail (i.e. the post, snail mail, etc.), which you do not open. This has been a long-standing tradition, and requires no further explanation to the courts -- which is the only place this will be of any use because if someone has stolen your idea, that will likely be the only way you will get any recourse.

    However, you do have to watch out: Some jurisdictions count first to patent as golden (unless the first to invent gets it out publicly enough, i.e. published in a journal, or the like, in which case prior art can take effect.).

    IANAL, but I think you have to look at it very carefully. Sometimes the best thing to do is to file the patent, or register the copyright, and then license it for free. That always leaves your options open.

    As per usual, your best option is to consult a lawyer in the field of IP. That is the only way to get meaningful advice on the subject. If it is not worth your time and money to do so, then your novel IP probably isn't worth you taking any steps to protect.

    Or, you could just give it away, and see what happens.

  11. Re:I develop scada software... Forbes is FUD on SCADA Systems a Target for Hackers? · · Score: 1

    I am going to do something rare here on slashdot...

    Let me appologise for a knee-jerk reaction written when I am tired and in a bad mood. I am just sick of this alarmism.

    I am going to say that yah, I too am part of the problem. I have a hard time imagining just how nasty some people are.

    My first post was a knee jerk reaction (you never see those on slashdot, right?) -- no one likes to see their industry trashed by a business magazine's uneducated and overly alarmist take on the subject, but in truth, there is a problem. The world has changed in the last 50 years since some of these systems were put together -- what used to be arcane knowledge of the engineering priesthood is now commonly available.

    Before I diatribe some more, I do want to make some technical comments:
    First, on controllers doing what they are told: SCADA systems shouldn't be built that way. SCADA is a supervisory control system, yes you can send whatever command you want, but ultimately, if the built in sensors detect a bad situation, they should be returning it to a safe state. That may mean production is stopped, which is expensive, but if RTU's are set up properly, they should be not able to do bad things.

    OPC and DCOM: Yup, vulnerable as charged. I know of service techs who do open up the permissions, though usually only as a debugging step. DCOM Security works well, when you understand it completly. I doubt there are more than 100 people in the world who do: It's a freaking mess. But once again, it's not actually that bad, if your system is not tied to the outside world. I have been places where lots of trouble could be caused... after you get letters from employers, safety quals, turn your passport in at the gate, etc.
    Certainly, the control industry has been taking these issues more seriously for the last couple years, but I think the parent does point out one thing clearly: systems security is a growing market place, and the people who make the biggest deal about it are the ones who make lots of money 'fixing' security problems.

    I still think that the forbes article is blowing it out of porportion -- afterall if it is such a big problem, and there are so many trying to disrupt north american lifestyles, why isn't there more cases of this?

    The simple answer is that most of the people out there that might be interested in doing this stuff are too lazy. Why take the time to do all that when throwing rocks at the antenna dish is cheaper, faster, and if it is in a far away place, less likely to get you caught? Usually, when these technical attacks do take place, I would expect that insiders are responsible most of the time -- they have the knowledge, they had access to the systems, they know what procedures are followed, etc. It again comes down to who you let in the door, and how you make sure they can't get back in when they are kicked out.

    The only point I had wanted to make in the first place is that the security risk that users of SCADA systems have to face first and foremost is the fact if you don't lock the doors, if you plug control systems into the outside world blindly, or if you make it a corporate point to screw over your employees, it doesn't matter how good your IT security and software is!

  12. I develop scada software... Forbes is FUD on SCADA Systems a Target for Hackers? · · Score: 1

    The long story short is that most of these installations are physically protected from intrusion. First rate firewalling, and in most cases, complete seperation of internet and operations systems are in place. Physical alarms and access controls, id badges, and real security guards do the rest.

    I am not naive enough to suggest that any such situation is 100% perfect, but at the very least, we are not talking about script kiddies. If someone has a real reason or agenda to break into these systems, and enough money and skillful crackers, they will get in.

    For example, WiFi ethernet networks are almost never used in these types of systems -- that doesn't have the engineering necessary for this kind of data. Instead, proprietary solutions with microwave dishes, and other forms of FCC/CRTC licensed data radios are used. While proprietary != secure, it does mean that a wardriver looking for an open access point isn't equiped to mess with these systems.

    Furthermore, scada systems have some intelligence on the terminal ends: hard wired or epromed/flashed programs running that usually have safety cutouts that prevent the hardware from doing something bad by dropping into a safe state.

    I won't go on boring everyone with the details, but what it comes down to is that the systems are sufficiently complex that it is cheaper, easier, and more effective to physically disrupt them, so there is not much point hacking or cracking them.

    In any case, in the automation world, this was news about 2 months ago, and taken into account in plant operations (mostly by noticing that the physical security and networking configurations prevent the attacks from the outside to begin with) without the kind of panic that Forbes is trying to fob out the unsuspecting C.O's (thats a regex .)

  13. Re:I usually stay out of gun control debates... on Gunplay Blamed For Cutting Fiber · · Score: 2, Insightful

    Since I am From Alberta, you can #include

    Really, the point is that it takes several generations to change the default units though - I learned to bake cookies (not the http kind, but the ones with chocolate chips) in a 350 degree oven (F, of course), and even though all new recipe books have the degC values, and my stove with a digital thermostat could display either, you can bet that it is configured to degF because while I can always convert the numbers, I can 'feel' out what 350 is, and know what things cook at on that scale.

    On the other hand, when I think of weather, and indoor temperatures, I can only work in metric. Then there are some measurements I can work in either fairly freely (but as noted elsewhere in the comments on this article, I can't convert them in my head well). I will estimate things in feet or meters or miles or km easily. However I can only work with driving speeds in kM/H.

    It is amazing how much the units we learn as children are locked into our capability to make estimates and exchange information with each other.

  14. Re:I usually stay out of gun control debates... on Gunplay Blamed For Cutting Fiber · · Score: 1

    Right you are -- it was a brain-o.

  15. Re:I usually stay out of gun control debates... on Gunplay Blamed For Cutting Fiber · · Score: 1

    Where were these cables, anyways? If they had been buried more than 2 feet (0.3 metres, roughly) in the ground, I don't think the rounds would penetrate that deep. The only way I could think of these not being buried is if they were already exposed for service, or if they were crossing a bridge (which is sometimes done in a steel conduit).

    Last time I dug up a shotgun slug from the ground after a target practice, it was less than 6 inches under ground...

    Therefore I guess the sabotage suggestion might make sense.

  16. Re:I usually stay out of gun control debates... on Gunplay Blamed For Cutting Fiber · · Score: 1

    In Canada, that is exactly the case. Mind you, I am in the first generation born since metricizing, but noone here knows there height in centimeters or their mass in kilos, unless they look it up on their drivers license.

  17. It doesn't really break the laws... on Perpetual Energy Machine Getting Lots of Attention · · Score: 1

    It is not truly a perpetual motion machine at all.
    It may be an ingenious way to get energy for no fuel type cost, but that energy is coming from somewhere. Actually, the source is cleary listed: Natural variation in the magnetic field. What that means is that the earth, and other heavenly bodies have changing magnetic fields, which from high school physics we know can be converted into energy. Now, I won't waste any time looking up the proper math and physics principles at play here, but the long story short is that in order for electrons or physical devices to move and interact with a magnetic field, an opposite force is applied back through the magnetic field to the processes that create the field in the first place, and cause it to move.

    Now we don't (as I understand it) fully understand all of the forces behind planetary bodies and the molten core of the planet moving, but I think it is safe to say that it is a rather large, but finite source of energy. The question becomes, will scaling this up to a cost effective sized system for commercial power generation ever draw enough energy from the earth to cause us problems in the long term? Or is the amount of energy drawn by this system to small to matter? (We are talking on geological/universal timescales here).

  18. Reverse cause and effect on Games Are No Cause For Murder · · Score: 3, Insightful

    One argument I have not heard very often, but I think should be brought to light, is that someone predisposed to engaging in violent activities may be drawn to violent video games, more than the average person. That point of basically allows that someone may use video games as an out, or that they could maybe be involved with pulling that person deeper into whatever is causing them to have violence problems. One wonders if the preconditions for someone who will be violence affects how they percieve themselves, and the real world versus the video game world.

    More simply put, seeking violent video games may be one of the effects, rather than the cause. The problem is that most gamers are not in this category.

  19. If I don't lock my front door, does that mean... on Michigan Man Charged for Using Free WiFi · · Score: 1

    it is not trespassing to just walk in?

    Come on people. At least the punishment was something appropriate to the crime. There is no requirement on the coffee shop owner to secure his wifi access if he doesn't think non-customers should be using it. It may be a good idea for the shop owner to do so, just as it is a good idea for me to lock my door, but that does not make it a requirement to make the law enforceable.

    As for the accused belief that he was doing nothing wrong... Well why didn't he sit in the coffee shop and use his laptop without buying something? Obviously because he would be asked to leave, or buy something. I don't buy the 'I wasn't doing anything wrong', or 'I didn't know it was wrong' line.

  20. Re:What is dark matter, any way? on Hubble Space Telescope Detects Ring of Dark Matter · · Score: 1

    It is a rare event that a reasonable question receives such an excellent answer on /.

    Thank you.

  21. What is dark matter, any way? on Hubble Space Telescope Detects Ring of Dark Matter · · Score: 2, Interesting

    I had been under the impression that 'dark' matter was simply regular matter that we needed to exist to balance some equations, but that we couldn't see. Wouldn't this simply reduce the amount of dark matter by making it observable?

    Or is my impression that dark matter is stuff we can't see wrong? Is it actually supposed to be some exotic substance (with comic-book like powers)?

  22. How about "Fair Use Control", instead. on HBO Exec Proposes DRM Name Change · · Score: 1

    Fair Use Control

    Might be a good new name. I can think of a few ways to end it, but I leave that to the collective imagination of /.

  23. Re:Can't we use both? on Hybrid Cars No Better than 'Intelligent' Cars · · Score: 1

    They both may avoid burning gas during deceleration, but the intelligent car model uses more information to decide when to start that braking -- I think a hybrid car could see some improvement by adding on the intelligent portion... That or retraining drivers...

    In other words, if you speed your hybrid up until the last possible moment and hit the brakes, you are not going to save as much if you choose to coast sooner and take it easy. Really the only reason I can think of that would cause having a hybrid to negate the affect of the the intelligent option is that hybrid owners are self-selected, and may tend to drive more intelligently with an eye on fuel consumption (considering that they have a gauge to show them that,) and will modify their own driving behavior. Who needs so much expensive infrastructure when a human being actually uses their marvelous brain power for efficiency instead of perceived speed and convenience?

  24. Free as in beer on Linux as A Musician's OS? · · Score: 3, Interesting

    One notable flub in the article: There is a terminology section following the article. It takes the time to discuss free (as-in-speech) vs. free (as-in-beer) -- this is a good thing. However it suggests that pirated commercial software is free-as-in-beer, albeit illegal... That's like saying knocking off a beer store with pantyhose over your head nets you free beer. The article misses out on software that is free-as-in-beer, but not free-as-in-speech (i.e. some hardware drivers, etc.)

  25. Re:Ah My! on Censoring a Number · · Score: 4, Insightful

    Actually, it penalizes the rich saps who don't have the know-how to override it. The poor saps can't afford the movies and music at the current prices of such things.