Slashdot Mirror


User: Myrrh

Myrrh's activity in the archive.

Stories
0
Comments
203
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 203

  1. Re:My Mysterious Car, House and Jewelry on The Tightening Net: Part One · · Score: 1

    Good idea, except that to establish credit, it's better to actually carry a balance and make regular payments than to charge stuff and then pay it off again right away. It sounds screwy but that's how it works ... your credit line will improve more quickly if you carry a balance and pay the balance plus the interest. That's what credit companies really like you to do.

  2. Re:script-kiddy culture is to blame on Undernet In Serious Trouble: Any Suggestions? (Updated) · · Score: 1

    Just an observation, but, uh ... if IRC is a place that magically makes scriptkiddies' penises "extend two or three whole inches," and yet as you say the same people "Have No Hope Of Ever Having Sex," then what's the point? Kinda paradoxical, don't you think?

    Female scriptkiddies notwithstanding, of course.

  3. Re:Try securing your boxen first on Undernet In Serious Trouble: Any Suggestions? (Updated) · · Score: 1

    As to your first case, I highly doubt that you would be held liable if someone were to steal your car from an effectively locked garage and then crash it. Even if you had modified the car, the modifications were (as far as we know for the purposes of this example) perfectly legal, and most likely your insurance company knew about the modifications anyway, since technically you should tell them. What makes you think that you would be held liable if someone were to steal your car and get in an accident?

    Whether or not your car has been modified, I think, doesn't matter. Are people held responsible if their cars are stolen and then used by the car thief to commit an act of vehicular homicide? I can't think of a case where that's true. I doubt whether the vehicle being modified would make any difference. Higher fuel capacity doesn't really have a bearing on the safety of the car, as long as a proven gas tank design is used.

    I think my counterexamples also apply to your examples 2 and 3. I don't really understand why or how you could be held liable unless it could be demonstrated that the modifications you made were unsafe.

    I guess I don't think this is a very effective analogy. Can you explain this further?

  4. Re:Try securing your boxen first on Undernet In Serious Trouble: Any Suggestions? (Updated) · · Score: 1

    True. The thing to remember is that, the more secure your box is, obviously, the harder it is for someone to get in. And script kiddies are, by definition, not the most skilled of hackers. They will go for the easiest solution, which is a wide-open box.

    I'm not saying that I don't secure my boxes. I do. But being held responsible for the actions of someone on my box despite my best efforts to prevent my box being used maliciously is, to me, a very scary proposition. It almost, almost, makes me think I'm in the wrong profession...

    But no. I love computers too much. =)

  5. Re:Try securing your boxen first on Undernet In Serious Trouble: Any Suggestions? (Updated) · · Score: 2

    Sure. People who run servers should, absolutely, always and no questions asked, be held completely responsible if their box is used to break into another box.

    Don't you realize that it is impossible, impossible to completely secure any box that has a network connection to the outside? Or, for that matter, a box to which anyone is allowed physical access? It's simply not possible. Not only that, but new vulnerabilities come out all the time! That's why we sysadmins read bugtraq, CERT and CIAC.

    I strongly disagree with your assertion that people running a server should be held responsible for breakins just as though they themselves had performed the breakin. It is not always--actually, rarely--the fault of the person who runs the box that was used to leapfrog. Sysadmins do their best to secure boxes to the best of their knowledge and ability, but we are busy people, and we have many other things to worry about in addition to network security.

    I would say that an ISP or a person running a server should take all steps possible to secure a server against attack, and be prepared to demonstrate that she did so if there is an investigation. Only in cases of negligence or deliberate malice should someone be held responsible for actions occuring on or through the server they run.

  6. Re:No way did they pull the Radon out of the Cube on Apple Punishes ATI For Leaking The Cube? · · Score: 1

    I was attempting to clarify a message that was posted by another person. I did not write the original post.

    Then perhaps you should make this clear? "the guy could and has run one of the greatest computer companies into the ground" is in the present tense, not the past tense. And trust me, Apple has completely turned around from the miserable days of Gil Amelio...

    It works as well in present tense as it would in past tense. Jobs nearly destroyed the company in the mid-80's. Who knows what might have happened if he had not been kicked out of Apple. So he went off and started his own company, NeXT, which made some awesome hardware but had unrealistic price points. Eventually they stopped making hardware and just sold software, which seemed to be going nowhere until--lo and behold--Apple bought them out and Steve was brought back to Apple. Funny how things come full circle sometimes.

    True, the days of Amelio, though they started with much hope, did turn out to be miserable. Amelio was a competent executive who didn't really know how to handle a computer company, and who threw money around left and right. I think it's great that Steve essentially threw Amelio out just as Jobs himself was thrown out ten years earlier. For once a boardroom battle has resulted in the turnaround of Apple, rather than what happened when Jobs was kicked out--Sculley was as bad for the company as Amelio was.

    But it doesn't seem like there's much evidence to support this allegation. ATi claim that he did this. I haven't seen Jobs/Apple's side of the story. There are at least as many reasons to not believe this as to believe it.

    True, we have heard only one story. But then again, has Apple come forward and issued a statement to clarify what actually happened? Nope. It seems they don't care, or they have more important things to do. In either case, it would be a good idea to give the public some idea of what actually happened ... but we're victim to the ongoing soap opera that is Apple.

  7. Re:Sell it to Los Alamos! on Id Auctioning Off SGI That Created Q2 And Q3A · · Score: 1

    We don't need it.

    We already have 192 of these, with 16 *working* processors each.

    Sandia National Laboratory might be interested, though...

  8. Re:No way did they pull the Radon out of the Cube on Apple Punishes ATI For Leaking The Cube? · · Score: 1

    We're referring to how Jobs ran the company into the ground in the 80's, not today. Today he seems to be doing a fairly good job--at least, he's brought the company back from the brink. Or so we've been led to believe.

    I find it pretty amazing, though, that the CEO of one of the largest computer companies in the world is basically acting like a child. Somebody does something he doesn't like, so he throws a tantrum and retaliates. Certainly he had every right to do what he did--but it doesn't strike me as very professional. If anything, ATI's leak probably generated even more publicity for Apple. This article about Jobs doing what he does best--piss people off--is garnering even more publicity for Apple. The plans within plans within plans boggle the mind. I keep wondering if Steve's reasons for doing what he does are not immediately apparent.

    Apple's too much like a soap opera, and always has been. I've read a lot of history about the company from the 80's. It's a fascinating story. In fact, I find Apple far more interesting from a business perspective than I do from a computers perspective. Aside from the eye candy that we're treated to every summer, I really don't care all that much about Apple's products.

  9. Re:apple cuby on Apple Cube Confirmed · · Score: 1

    Logically, that statement doesn't make sense. Read it again.

  10. Re:Apple's site is SOOOO SLOWWWW on MacOS Keynote Coverage · · Score: 1

    I just looked at it a minute ago and it says:

    www.apple.com is running Netscape-Enterprise/3.6 SP3 on Solaris

    Where are you getting OS X from?

  11. Re:Cube and breadmaker: Separated at birth? on Apple Cube Confirmed · · Score: 1

    Wow, mine's an Apple too. But all it will make is Blueberry. My attempts to make lime, strawberry, tangerine or grape have failed. That, and it can't run any of the latest games. And I never really learned how to make bread, I just sorta point and click. I sure wish I had a *real* breadmaker, which would actually teach me how to make bread, rather than just dumbing it down so that anybody off the street can bake some. Oh. And it cost twice as much as my neighbor's plain breadmaker, which incidentally makes all kinds of flavors.

  12. Cube and breadmaker: Separated at birth? on Apple Cube Confirmed · · Score: 1

    Does anyone else think that the new Cube looks just like a breadmaker machine?

    Or possibly a Brita water filter pitcher?

    I'll bet this new Cube makes an even better fish tank than the old 128K's.

  13. Re:My notes from the Webcast on MacOS Keynote Coverage · · Score: 1

    Yeah, reminds me a lot of NeXT, except that the NeXT cube looked a lot cooler. For one thing, it was magnesium, which is very strong. For another, it was black. For yet another reason, it was bigger--1'^3. And it wasn't a sham cube--the box itself was cubical, not a cube encased in a plastic box.

    Funny how things seem to be coming full circle at Apple. I wonder what Steve's hidden agenda is.

  14. Re:Apple's site is SOOOO SLOWWWW on MacOS Keynote Coverage · · Score: 1

    They don't run MacOS for their servers. They run Solaris.

    See Netcraft if you don't believe me.

  15. New Cube looks like a breadmaker! on MacOS Keynote Coverage · · Score: 1

    Does anybody else think the new G4 Cube looks like a breadmaker machine?

    Or a Brita water filter pitcher?

    I bet this model will make a great fish tank!

    Heh heh.

  16. Re:Why isn't Woz a rich bazillionaire? on Wozniak Interview In Failure · · Score: 1

    Uhm, ever heard of a challenge exam?

  17. SlashTechnica on Ars Reviews Honda Insight · · Score: 1

    Christ ... why don't we just combine Slashdot and ArsTechnica, since both sites pimp each other so often. Doesn't damn near everyone who reads Slashdot read ArsTechnica too? Don't you guys have *real* news to report on, rather than just scouring other news sites and reporting on what they've already posted?

    Geez.

  18. IE 5.5 *is* the standard! on Microsoft's IE 5.5 Flouts Industry Standards · · Score: 1

    Somebody please define "standard."

    Seems to me that if 9 out of 10 people are using IE, then IE is the standard, and Web sites should be IE compliant.

    Netscape is behind the times. Its products are bloated, unstable, and lagging behind IE both in performance and features. IE, on the other hand, is stable, somewhat lean, and feature rich. And nearly everyone is using it.

    I'll stick with what the standard is--the browser that everyone uses, IE. It's my choice and keeps getting better with every release. It's an example of something Microsoft has done right.

  19. I would save nearly everything, but keep it safe on What Kind Of Logs Should ISPs Keep? · · Score: 1

    I used to work for an ISP as a network admin and security "expert," so I've got some experience in this area.

    When I was hired on I implemented a policy of making sure all the server clocks were correct (via NTP) and synchronized to each other. That way our logs would correspond, and we could check all machines if something went flaky on one. Sometimes cracking happens on only one machine; sometimes it happens on multiple machines almost simultaneously. The first step towards having credible logs is to make sure the date stamp is correct on all of them.

    Another policy I would implement, if I had the support of management (and adequate disk space) would be to save everything except for the data that actually travels over the pipe. I would save a record of all outgoing data, so we would know what went out from our site to the outside world. I'd also probably try and log most or all the traffic on the internal network (our IP block). Obviously an ISP would run into privacy entanglements if everything--incoming and outgoing--was logged (not to mention doing so would require enormous amounts of disk space), and might even be operating contrary to its stated policy.

    It would be possible (and would require far less space) to just log packet headers, not the actual content of each packet. Knowing what the packet types are is often a useful diagnostic tool, both for knowing what the heck your network is doing and for (somewhat) knowing what people are doing on your network. Of course, this is better done at the router, probably.

    We considered syslog, even with everything turned on, to be inadequate for logging purposes. Of course, any sysadmin worth his salt uses tripwire, ISS, COPS, etc, and keeps extensive records associated with these tools.

    We installed ZoneAlarm on all of our Windows machines and encouraged our customers to do so as well--this helped give us a heads-up on several potential hackers. We configured ZoneAlarm to keep extensive records as well.

    My personal policy is to keep it, no matter how small or insignificant. Don't trash anything. You should see my pine mailbox directory--it's huge. But of course I can't apply this principle to everyone, as I have no desire to be another fascist sysadmin. But I can imagine there are those who would keep everything.

    If you do keep everything, or nearly everything, for crying out loud keep it safe. Have a separate machine that performs as a loghost and make it secure. More secure than any other machine on your network. In fact, make it impossible to get in unless you're on console. Make backups religiously and store them off-site. It may save you or one of your customers in case of disaster or overzealous law enforcement.

  20. Re:Already done on Hacking Satellites To Spot Gamma Ray Bursts · · Score: 2

    They haven't discovered only one. There's thirteen recorded gamma ray bursts on record. They're exceedingly rare, though, so you'll never see an astrophysicist more excited than when a gamma ray burst is detected.

  21. Not news ... on Hacking Satellites To Spot Gamma Ray Bursts · · Score: 3

    I recently attended a lecture at Los Alamos National Laboratory on gamma ray bursts, and discovered that scientists have had this technology for some time. From the time a satellite detects a gamma ray burst and pinpoints its position and transmits a signal to an automatic ground-based telescope, to the time the ground-based telescope swings around and points at the gamma ray burster is six seconds. And this has been around for a while. Nothing new.

    Now if this latest technology improves that time, then that would be interesting.

  22. Re:Listen security morons on Colleges Urged To Ban Telnet And FTP · · Score: 3

    Exactly.

    I'd be a lot more concerned about POP3 than telnet. Last year at my school it was discovered that someone managed to get the passwords of nearly half the students simply by sniffing the POP3 packets. (One could of course argue that this could have been achieved via simply sniffing all packets--people generally have the same password for POP email as they do for telnet and FTP--but my point is that it was found that a LOT of people on campus use POP clients to read their email. Far more people use POP to read email rather than simply ssh'ing in and using pine (my preferred method, which is significantly more secure).

    I'm aware that most POP clients provide support for client-server encryption so the passwords are not sent plaintext, but my school never quite seemed to think that was worth the trouble, even though the vast majority of people are comp. sci. students who could probably handle such additional complexities with ease.

    The fix to "all this" is *not* to ban protocols or limit the availability of services to students. Students subsidize the campus information infrastructure through their fees and tuition. The solution is to educate everyone on campus--faculty, staff and students--to use encryption whenever reasonably possible (ssh is not non user-friendly or invasive), and to use strong passwords. A lot of script kiddies and not-so-good hackers are born as a result of a campus trying to limit students' capabilities.

    At the very least, I know a lot of people (myself included) who would have a few words to say to those in charge if it were decided that banning things, rather than employing workarounds or educating the people, was the correct solution.

  23. Re:Goodbye quick and easy access on Colleges Urged To Ban Telnet And FTP · · Score: 1

    Yes, they could use a sniffer, if the person were using a command-line mail program like pine, elm, etc. Not all mail programs are POP clients that run locally. I like pine a hell of a lot better than Eudora or Outlook or just about any POP client.

  24. What alternative to FTP? on Colleges Urged To Ban Telnet And FTP · · Score: 1

    I can understand banning telnet, because there is already a widespead substitute in place--ssh--that is secure and generally considered superior to telnet. Many places, schools included, have already turned off telnet (it's as simple as editing /etc/inetd.conf) and have started enforcing an ssh-only policy. Since ssh is available for just about every platform, there's really no reason to argue (unless you can't handle ./configure; make; make install).

    My question is, what alternative does Mr. Garfinkel offer to FTP? HTTP is too slow and inflexible to replace FTP. Are there more secure solutions out there that do the same thing as FTP? And if so, why are they not more popular? All the major OS vendors have endorsed both telnet and FTP (see Red Hat, Sun, SGI, etc) by enabling them by default on their OS's. If there are such superior alternatives, why haven't they caught on yet?

  25. A terabyte? Come on, figure it out... on Titan AE Distributed Digitally · · Score: 1

    A terabyte is actually a really good estimate. Did you do that in your head?

    I figured it:

    Average modem speed is 56kbps (well, actually, I get 50,667 max, but for our purposes we'll say 56,000 bps).

    800 x 56000 = 44,800,000 bps =~ 45Mbps (roughly the speed of a T-3, completely maxed-out, which would be difficult to do if more than one hop were involved).

    4 hours = (60 sec x 60 minutes x 4) = 14,400 seconds. 14,400 seconds x 44,800,000 = 6,451,200,000,000 bits, i.e. 6.451 terabits.

    To get the number of megabytes, we divide by 8: 6,451,200,000,000 / 8 = 806,400,000,000 bytes, which is 806.4 gigabytes, which is 0.8064 terabytes.

    I'm impressed...