Slashdot Mirror


User: JesseMcDonald

JesseMcDonald's activity in the archive.

Stories
0
Comments
3,955
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 3,955

  1. Re:And this folks... on WordPress Creator GPL Says WP Template Must Be GPL'd · · Score: 1

    A typical derivative work registered in the Copyright Office is a primarily new work but incorporates some previously published material.

    This is a good description of most kernel modules, as the new work (module-specific source code) tends to be overwhelmed by the quantity of straight kernel code (header files) included during compilation. This does not necessarily contaminate the source itself, which only references the header files by name, but the resulting binary would incorporate at least some kernel code (e.g. macros, inline functions). As such, if you ever intended to distribute the module in binary form you would also have to include the complete source code under a compatible license.

  2. Re:And this folks... on WordPress Creator GPL Says WP Template Must Be GPL'd · · Score: 1

    If I write a module for the linux kernel it is noa derivative of the linux kernel. The binary it produces likely is, and once loaded into the kernel it is (but no one distributed the running kernel memory image...). But the source code? No way.

    That is your opinion. Others have argued differently, in the event that your module was written specifically to be used as part of a Linux kernel image and makes use of its internal APIs. Some of their arguments are quite persuasive, to the point that major corporations (e.g. nVidia) take them seriously and release the Linux-specific portions of any kernel modules under compatible open-source licenses. It helps their position that the kernel developers clearly delineate the boundary between internal and public APIs.

    Are all my C programs derivatives of libc because they call libc functions and libc functions call into it?

    In that case you are not dependent on any particular implementation of the C library. You should be safe so long as you stick to the standard library routines. If you program was dependent on APIs only present in a particular GPL-licensed implementation of libc, that might be a different matter.

    And what happens if someone clean room re implements the WP theme interface? Suddenly though the code hasn't changed at all, the theme isn't GPLd?

    No, it would still be a derivative of the original code. The clean-room implementation would make it possible to implement other themes which were not derivative, however—assuming it wasn't itself considered derivative.

    Note that as a copyright abolistionist I can hardly be said to support this interpretation; I'm just pointing out that it isn't quite so clear-cut as you seem to think. There appears to be very little legal precedent regarding software APIs and derivative works. Some think even network interaction should count (e.g. web services), while others, such as yourself, would prefer to ignore the use of APIs entirely. Copyright is meant to cover creative expression, not pure ideas, processes, or interfaces, and has been set aside before when doing so was necessary to permit interoperability (e.g. the Lexmark ink cartridge case). On the other hand, you can hardly argue that your module would be of much use to anyone without a Linux kernel to run it in, and you must have referenced the kernel source, or documentation derived from it, during the implementation, since the APIs don't exist anywhere else.

  3. Re:Who pays for the electricity? on Micro Plane That Perches On Power Lines · · Score: 1

    That would not reduce the range of your WiFi: the rf would be absobed by the body of the cellphone user anyway ...

    The problem is that they wouldn't just be absorbing the radiation. Well, I suppose they could just absorb the signal (and generate a minuscule amount of power from the resulting heat), but it wouldn't be very practical. When you collect power from EM radiation via induction, whether the source be high-tension power lines or a WiFi hotspot, the induced power creates an inverse transmission that partially cancels out the original field around the receiver. In the case of WiFi the result would look a lot like multipath interference. In the case of power lines this backinduction places a greater load on the generators, just as if a normally-connected household had turned on additional appliances. The more efficient the inductive connection is, the greater the apparent load.

    If you don't want me to absorb your radiation and put it to use don't spray it at me[.]

    On this point we are agreed, but they're not really objecting to you receiving free energy so much as to your unintentional interference. If you somehow managed to simply absorb the radiated energy without sending anything back they would have no reasonable basis for complaint.

  4. Re:Interference in another country's laws on Obama Won't Intervene Over British Hacker McKinnon · · Score: 1

    I personally consider aspects of US Law, like your constant reference to an 18th century document to deal with 21st century issues, to be laughable.

    That "18th century document" is the only thing giving the United States federal government any legal standing whatsoever. Without it they have plenty of practical power but no legitimacy. Ergo, it has significant bearing on every aspect of U.S. law. Its age is irrelevant.

    Government is force. That is its sole purpose. It is quite possibly the most dangerous thing there is in modern society, more insidius than organized crime, more deadly than terrorism, and potentially more disruptive than a full-scale foreign invasion. It is tolerated only because most people seem to think that some aggression is necessary to keep society from collapsing. (Needless to say, I am not among them.) It would be lunacy to concentrate and legitimize that kind of force and then call the document which created it and defines its boundaries "laughable".

    We're not just talking about a random scrap of 18th-century political philosophy here. In a very real sense, the U.S. Constitution and the U.S. Government are one and the same thing, and very much worth taking seriously.

  5. Re:About Software on Windows Vulnerable To 'Token Kidnapping' Attacks · · Score: 1

    Moreover, in this particular instance, the file is included with '#include <stdio.h>' (as opposed to '#include "stdio.h"'), which means the compiler will look for it first in the system include directories (e.g, /usr/include).

    The include search path can be overridden on the compiler command-line (-I) or via environment variables (C_INCLUDE_PATH), both of which take precedence over the standard ("system") search path, so there is no guarantee that the file will not be unexpectedly located in some compromised directory under the nominal control of the current user.

  6. Re:Who doesn't hash/encrypt passwords? on OAuth, OpenID Password Crack Could Affect Millions · · Score: 1

    I don't see why not, but you should bring that up with a full-time cryptographer before implementing it. Just because I can't see a weakness doesn't mean there isn't one. :)

  7. Re:Who doesn't hash/encrypt passwords? on OAuth, OpenID Password Crack Could Affect Millions · · Score: 1

    Where did you get the idea that I am storing encrypted passwords...?

    Well, let's see. There's the part where your original code calls "Encryption.encryptString"; it appears that this was simply misnamed. I didn't see the other comment where you posted the detailed code, as it wasn't scored as highly. There's also the part of the comment I was replying to which said:

    Salt is only useful to protect the encrypted passwords, so if someone got the database and wants to decrypt the passwords.

    Apparently you were just being (extremely) imprecise. Encryption and decryption are two-way operations; transformation from plaintext to cyphertext and back is meant to be easy provided you have the key. Properly speaking, you can't decrypt a hash value, and hashing is not a type of encryption.

    I freely admit that I drew the wrong conclusion, though that was hardly unreasonable considering the evidence presented presented to me. I apologize for incorrectly disparaging your understanding of this aspect of cryptography. In the future I will seek more information before responding.

    As for the difference between a constant "salt" which must be kept in the application's memory (even if the physical disk it was loaded from is removed) and a unique, random salt value stored in a database, it should be obvious which is more secure—but this thread is too long already. Suffice it to say that the problem with your scenario #7 is that the attacker will have the salt, having read it from the running application with a debugger (for example), and thus can perform all the attacks possible in the properly-salted configuration (case II) with the added advantage that the hashes will not vary between accounts, requiring only a single look-up table. Removing the input file does little to keep the salt value hidden compared to storing it in the database.

  8. Re:Who doesn't hash/encrypt passwords? on OAuth, OpenID Password Crack Could Affect Millions · · Score: 1

    I'm afraid it is you who does not understand the purpose of salt, nor the concept of hashed passwords in general.

    The reason that you and the other commentators in this thread cannot see eye-to-eye is that what you are calling "salt" is not salt at all, but rather a private encryption key. You are not storing password hashes in your database, where salt would be relevant. You are storing the actual passwords, albeit encrypted. If anyone were to get the private key you're using—which is relatively trivial if they've already broken into your system, even if the original file is no longer present—they could trivially decrypt all the passwords. The security risk is that many of these passwords will be used for the same account names at other sites, so breaking into one weakly secured system can potentially provide login details to user accounts on many other systems. This is why every book on security tells you to never store the actual password, and rely on hashing instead.

    The point of storing hashed passwords is that even knowing the hash (and the salt, if present) will not get you the original password, as the hash is a one-way function. You can check whether the provided password is the one that was originally hashed by repeating the process, but nothing in the database will tell you what the password actually is. However, one weakness is that, without salt, an attacker can precalculate huge tables of common passwords and their hash values, at great expense, and thus map hash values back to the original passwords without actually brute-forcing the hash function for each password. Since unsalted hashes are static these tables can be reused over and over again. The solution is to add unique random data ("salt") to each password before hashing; every salt + password pair will have a unique hash, making such tables impractical. There is no need for the salt to be kept private, but it does need to be different for every account to be effective. The salt has to be stored so that you can later check whether a given password, plus the known salt for the account, hashes to the same value as the correct password.

  9. Re:I must admit... on Wireless PCIe To Enable Remote Graphics Cards · · Score: 1

    Could you be more specific? My understanding is that PCI/PCIe devices have the same access to system RAM as the CPU(s), unless an IOMMU is present and programmed to prevent it.

  10. Re:I must admit... on Wireless PCIe To Enable Remote Graphics Cards · · Score: 5, Interesting

    Some recent systems have IOMMUs which provide privilege separate between hardware devices much like normal MMUs govern software. However, unless this sort of IOMMU device is active, PCI and PCIe hardware is generally capable of transferring data to or from any other connected device, including any area of system RAM. Sometime this can even extend to external interfaces; for example, people have been known to take advantage of the DMA capabilities of the Firewire protocol to read the contents of RAM on an active system.

    In general, non-hotpluggable hardware has been granted the same level of trust as the OS kernel, so no one worried very much about it. IOMMUs were more about protecting against faulty or corrupted software (device drivers) than malicious hardware. However, more and more hardware is hotpluggable these days. Also, some software interfaces are becoming too complex to really trust—consider, for example, the interface to a modern GPU, which must transfer data to and from RAM, and perhaps other GPUs, under the control of code provided by user-level application software (shaders, GPGPU). Without an IOMMU it is up to the driver software to prove that such code is perfectly safe, which is an inherently hard problem.

  11. Re:I think someone fails to comprehend... on Open Source Music Fingerprinter Gets Patent Nastygram · · Score: 1

    In the event that a "detailed explanation of how to implement it" and "a functioning implementation" are one and the same thing, I should think it quite obvious that free speech must always trump patent monopolies. After all, Congress is only permitted to grant patents—not required to do so—whereas they are absolutely prohibited from infringing on free speech per the 1st Amendment.

    That it is even possible for the description and the implementation to be identical is one of the many flaws inherent to software patents.

  12. Re:Perjury on Google's New Scheme To Avoid Unlicensed Music · · Score: 1

    Not even that, actually:

    Sec. 512.b.3.A) To be effective under this subsection, a notification of claimed infringement must be a written communication provided to the designated agent of a service provider that includes substantially the following:

    ...

    `(v) A statement that the complaining party has a good faith belief that use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law.

    `(vi) A statement that the information in the notification is accurate, and under penalty of perjury, that the complaining party is authorized to act on behalf of the owner of an exclusive right that is allegedly infringed.

    So the "penalty of perjury" clause doesn't apply to the claim of infringement per se, but rather to the claim that one is authorized to act on the alleged infringement. The allegation itself is required only to be a "good faith belief".

  13. Re:Variety is the spice of life on A Flood of Stable Linux Kernels Released · · Score: 1

    For example, the entire devfs subsystem was removed completely in kernel 2.6.13. If you had something that depended on the existence of devfs, you could not upgrade to 2.6.13 or later until you got rid of your dependance on devfs.

    And if we were still using the old version number format, and devfs had been removed in 2.7.13 or 2.8.0 rather than 2.6.13, you still would not be able to upgrade to that version or later until you'd removed your requirement for devfs. Features would still tend to be introduced in the same order, after all—they'd just be even later in getting to actual users. You get the same effect by freezing your distribution at, say, 2.6.27, and backporting only security patches and bugfixes until you're ready for the next major release.

  14. Re:From TFA on Germany Takes Legal Steps Against Facebook · · Score: 1

    When a co-op breaks up the assets are divided between the employees.

    In my (albeit limited) experience, co-ops tend to be owned by their members (customers), not their employees. Of course, a co-op is just a special form of corporation, and could easily be organized along lines similar to what you describe, among many other possibilities. Even with a normal publicly-traded corporation all you have to do to insure yourself against a break-up is purchase some shares of preferred stock—although by the time a corporation (or co-op) reaches the point of breaking up it's generally sold off any assets worth fighting over.

  15. Re:OMFG on George Lucas C&Ds 'Lightsaber Laser' · · Score: 1

    He only cares that they look too much like Star Wars lightsabers.

    Which part? Star Wars lightsabers have exactly two external identifying characteristics: a flat, exposed "reflector plate", and a beam that magically stops a few feet from the hilt. The hilts themselves were up to the users. Some were artistically handcrafted, but more often they were just constructed from convenient junk; no two were entirely alike. Since this product lacks both the "reflector plate" and the characteristic shaped beam, I fail to see how it is in any way like a Star Wars lightsaber.

  16. Re:Other countries should start policing Internet on US Pirate Movie Site DNS Seizure Fail · · Score: 1

    ... the majority of people like their congressman.

    What makes you say that? All that can be inferred from the electoral record is that a plurality of the voters in a given congressman's district liked him/her better than his/her opponent—assuming there was an opponent, which is not always the case. The least-disliked out of a small pool of self-elected candidates may yet be disliked by a majority of those he or she pretends to represent, particularly if one believes, as I do, that no one who would willingly choose to become a politician should by any means be entrusted with the task.

  17. Re:Acceptable... on Indian Government Threatens RIM, Skype With Ban · · Score: 1

    Except that the GP's suggestion was neither government-like nor evil. Where is the coercion? That is what is evil about government, and there is no coercion in simply refusing to interact with someone.

  18. Re:So how much of this will the telcos steal? on New US Broadband Projects Get $795 Million In Funding · · Score: 1

    If that were all it was then the money wouldn't have to be taken by force. No, taxes are how other people pay for their civilization with your money. Involuntarily depriving someone else of their rightfully-owned property is theft by any sane definition, regardless of the intended use.

  19. Re:Educated, not crazy and not afraid. on Unique ID In India Causes 'Fear of the Beast' · · Score: 1

    Are there still people around who confuse liberty and anarchy?

    Are there still people around who confuse anarchy and chaos?

    "No rulers" is not the same as "no rules".

  20. Re:Blah on Unique ID In India Causes 'Fear of the Beast' · · Score: 2, Interesting

    You can without a doubt easily prove that the world is older than 4,000 years, yet there are many Christians that will tell you otherwise.

    This should be good. How do you intend to prove that the world actually is older than 4,000 years (shouldn't that be 6,000?), as opposed to simply appearing older? The appearance of age is inevitable, and proves nothing. These Christians are not claiming that the world came about by natural causes within the last few thousand years, you know. There is no way to disprove creation ex nihilo, whether it be four billion years ago, four millennia, or four minutes.

    That, of course, is the whole problem—once you start believing in things which cannot be disproved you've pretty much given up on any lingering pretense of rationality. Fortunately, tolerance doesn't mean you have to internalize other people's beliefs; it just means that you won't reject someone as a person simply because you disagree with them. It is perfectly possible to tolerate religious individuals without accepting the truth of their worldviews or endorsing their actions.

  21. Re:China is the model the west wants to emulate on Google To End Google.cn Redirect · · Score: 1

    There are no serious Libertarian candidates. That's the nature of Libertarianism. No serious, thoughtful person takes that ideology seriously.

    Well, what did you expect? The concept of a "libertarian" political party (Libertarianism, capital 'L') is a contradiction in terms. The libertarian ideology rejects all aggression, of which political action is a strict subset. Ergo, only those who are incapable of seeing the contradiction or are willing to compromise their supposed beliefs for political power ever become Libertarian candidates.

    Even so, Libertarian Party candidates have been elected to political office, which means your statement that "there are no serious Libertarian candidates" is clearly false. Even at the national level there are politicians currently in office with close ties to the Libertarian Party, which is about as much as can be expected of any third-party candidate in the current two-party electoral system.

  22. Re:cool on ESA's GOCE Satellite Provides Gravity Map of Earth · · Score: 1

    I'm no expert, but it looks like they calculated an isosurface (a surface where every point has the same perpendicular gravitational pull) and colored their map based on the difference in height between this isosurface and the surface of the normalized sphere. On a normalized sphere (e.g. at sea level) gravity would be stronger where the isosurface is higher and weaker where the isosurface is lower.

  23. Re:Free Speech on SCOTUS Nominee Kagan On Free Speech Issues · · Score: 1

    However, not being able to shout fire in a full theatre is censorship that I have trouble arguing against.

    Can't we just all agree that this was an extremely poorly conceived ruling in the first place? Supposedly the logic goes as follows: 1) Someone shouts "Fire!" as a prank; 2) People panic; 3) Panicking people cause injury to others in their haste to leave; 4) Someone must be held responsibly for this injury; 5) The prankster is the one that started it all, ergo he/she is responsible.

    The problems with this line of reasoning should be obvious. First and foremost there is the fact that it is not the original prankster who caused the injuries, but rather the people who panicked and selfishly trampled others in their haste to escape. If anyone is responsible for the injuries, they are. Second, the prankster certainly never intended for anyone to be injured, and while unintentional injuries resulting from an illegal act (e.g. arson) are held against the offender as if they were deliberate, the same is not true for injuries resulting from legal acts; these are considered accidental, and subject, at most, to civil reparations.

    The intent of the 1st Amendment is plain, IMHO: speech is never to be illegal per se, regardless of content. If one can legally say something in a given context then one can legally say anything. More generally, only non-consensual interactions between individuals are the proper subject of the law. Speech is nearly always consensual, and even where it is not (harassment) the offending action is speech itself, not the content.

  24. Re:Definitions please on SCOTUS Nominee Kagan On Free Speech Issues · · Score: 1

    I am 100% pro-personal freedom.... I think that whatever happens between two legally consenting adults (whether it involves cash transfer or not) is not the governments business.

    The government SHOULD have regulatory power to prevent monopolies, promote competition, and prevent stupid decisions like those that lead to the housing bubble.

    Can you not see that these positions are contradictory? The commercial actions of private businesses are inseparable from the actions of their owners, who are legally consenting adults. Commercial transactions are a subset of "whatever happens between two legally consenting adults", and thus—by your first statement—should not be subject to government interference.

    I also don't mind the government providing some level of social services. Public schools, the road system, even healthcare and homeless shelters.... I don't mind paying my fair share of taxes for those services to be provided....

    I don't think anyone will take issue with you paying whatever "taxes" you want, although they aren't really "taxes" if they're voluntary; the whole point of a tax is that it's imposed involuntarily by a third party. What you describe is more like a donation. Anyway, the objection is with forcing other people to pay taxes to fund such services as you approve of. Note that it makes no difference whatsoever that you think these others receive a net benefit, so long as they do not explicitly agree with you.

  25. Re:Why don't people keep cars longer? on High Depreciation May Slow Electric Car Acceptance · · Score: 1

    Part of it is a matter of reliability. If you're paying $1500 per year in maintenance, you probably won't want to take said vehicle on any long trips—what if it broke down along the way? Who wants to be stuck in the middle of nowhere with their car in the shop? Even for a simple daily commute you don't necessarily want the risk that your car won't get you to work when you need to be there. At that point you already need a second, more reliable vehicle as a backup, and since you can only drive one at a time you might as well trade in the old one.

    Also, you don't necessarily need to pay $400/mo. I just purchased my first brand-new vehicle (a 2010 Honda Fit Sport) with some optional protective upgrades, and the payments are still well under $300/mo. Moreover, I don't have to worry about how some prior owner may have treated it, since I'm the first. The peace-of-mind aspect should not be discounted.