Slashdot Mirror


User: tyler_larson

tyler_larson's activity in the archive.

Stories
0
Comments
293
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 293

  1. Re:Posting from an "Exploited" FF 1.5 on Unpatched Firefox 1.5 Exploit Made Public · · Score: 1
    You'll be able to even view your browsing history (including the offending page).

    Addendum:
    As you might expect, if you delete the offending entry from your history, everything returns back to normal: you don't actually have to do anything drastic like delete your history.dat file, or even clear your browsing history.

  2. Posting from an "Exploited" FF 1.5 on Unpatched Firefox 1.5 Exploit Made Public · · Score: 5, Informative

    False alarm. No security-related concerns, just overenthusiastic reporting.

    If you run the script below, it will create a page with a title that's quite huge. Close your browser and open it again. The browser will spin for about 2 minutes what it tries to make sense the contents of your history file. Once it's finished, you'll be back up and running, with no degradation in performance or visible side-effects. You'll be able to even view your browsing history (including the offending page). In fact, I'm posting this response after following the process described above (on WinXP), and I have a history entry entitled "AAAAAAAAAAAAAAAAA..."

    A bit of an annoyance, but hardly a security issue.

    Here's the official exploit code:

    function ex() {
    var buffer = "";
    for (var i = 0; i < 5000; i++) {
    buffer += "A";
    }
    var buffer2 = buffer;
    for (i = 0; i < 500; i++) {
    buffer2 += buffer;
    }
    document.title = buffer2;
    }
  3. Re:why it is cheaper. on Fiber Optic vs Copper · · Score: 4, Informative
    The article caims that fiber networks are cheaper based on the the following assumptions:
    • All networks run at 1Gbps or higher. No one needs a slow network.
    • All network installations must be certified, and the certification cost for a fiber network is less than for a copper network.
    • The allowed size of copper networks decreases dramatically with ultra high-speed networks. Fiber links are allowed to be really long. That difference means huge cost savings to the fiber user.
    • With a huge network, the amount of space taken up by switchs and other equipment is smaller for fiber networks. Also, the space taken up by that extra copper switch is extrememly expensive.
    • Fiber has an operating temperature range that's wider than copper's. You have to spend extra money on climate control if you use copper.
    • Fiber networks are more robust and secure: fiber doesn't conduct lightning strikes. That's worth a lot of money.
    • Every so often, a new copper standard comes out, and we all have to upgrade. We've had Cat3, then Cat5, then Cat5e, then Cat6, etc. Boy, that's a lot of copper wires to install! Fiber doesn't go through as many iterations. Fiber users will save billions in future upgrade costs.
    So, despite the fact that fiber equipment is so much more expensive, you can see how the savings really start adding up when you figure out the fiber TCO.
  4. Re:Let's give a hand to Bill on Bill Gates Donates $258 Million to Fight Malaria · · Score: -1, Flamebait
    this a true gift of philanthropy

    I wish I could afford to give $250 million to some charitable cause.

    Even more, I wish I made enough money to make it an advisable tax move. Let's not forget where that money came from.

  5. Re:They created it, now they have to deal with it on Court Battle Over Internet Calls · · Score: 1
    Why aren't more criminals using PGP encrypted email?

    You know the old adage:

    If encryption is nerdy, only nerds will have encryption.
  6. Re:Hmmm, interesting projects on Google Summer of Code Results · · Score: 1
    I have always wondered when I would be able to mount remote file systems via secure shell.

    You mean like this?

    ssh host sudo mount //server/share /mnt/nfs

    It seems simple enough...

  7. Re:Doesn't matter yet on Microsoft & Linux Should Co-Exist In China · · Score: 1
    As China evolves these protections will have to be developed and enforced; they'll need them to protect their own content-creators, not just foreign ones.

    That's an interesting opinion. The whole concept of "owning" the content you create is fairly new and, in fact, quite artificial. There really is no pressing need for a country to create any sort of content-protection scheme. If musicians don't get paid for the songs they sing, you may lose the whole celebrity rapper subculture, but the country really isn't any worse off economically.

    In fact, the quality of the content that the country generates does not necesarily have to even decline: sure, you'll lose quantity, bot not necessarily quality. Othe only ones creating content will be the ones who do so for the love of the work they do, rather than those just looking for money.

  8. Re:Groklaw Interviews MySQL AB CEO Marten Mickos on The Ups and Downs of MySQL AB · · Score: 3, Insightful
    The backlash against MySQL for dealing with SCO is harsh, probably unwarranted, but, most importantly, very effective at conveying the desired message: don't talk to SCO. Don't even return their phone calls.

    SCO, you remember, is a UNIX company--they don't write all their own software, which is why their OS is POSIX. They absolutely rely on cooperation with the community to make their product marketable.

    Now, they're blacklisted. Companies and projects that use community-driven models (or even market to such organizations) are clearly and unequivocally forbidden to associate in any way with SCO. It's just not worth risking the sort of backlash that hit MySQL.

  9. Re:Nice. on Neiman Marcus Offers First Moller Skycar For Sale · · Score: 2, Informative
    How long does it take to get a drivers license in US, and how expensive it is?

    The requirements vary by locality, and are getting more restrictive as time goes by. However, when I got my driver's licence, I only had to pass the written test and the "drive arount the block with a DMV guy" practical test. Total cost was negligable. Total experience required was laughable.

    Note that making license acquisition even moderately expensive or difficult is a very politally-charged proposition. Leftists tend to argue that a driver's license is required in order to conduct normal day-to-day business, and therefore is a right, not a priviledge. Making license acquisition out-of-reach for the "bottom" of society--those with less resources and less opportunity for proper training--impinges on the rights of these individuals and is an unacceptable form of discrimination.

    When I got my pilot's licence, on the other hand, it was after 41.5 hours of flight time (I learn very fast, the national average is 60 to 80 hours before they can perform maneuvers within FAA standards), at a cost of around $4000. Once again, the average cost is closer to $6000-$8000 dollars. The requirements also include a written exam (a REAL test, not the hokey crap you do with the DMV), an oral test, and a practical test. Only the first hour or two of training is spent explaining "how to fly." The rest is spent learning how to safely handle every situation you can possibly get yourself into (of which there are plenty, by the way).

    Along with your license, you need a current medical release signed by an FAA approved doctor, which needs to be updated as often as every 6 months or as seldom as every 3 years (depending on age and what type of flying you do). And of course, there's recurring training that must be accomplished every 2 years. Beyond that, there's requirements about flying you must have done within the past X months in order to carry passengers in various situations.

    None of this includes instrument or commercial ratings, either, and is only valid for the specific category of aircraft that you trained in.

    So, in order to fly, you have to really know what you're doing. The requirements are strict because the stakes are high. If drivers were required to reach pilot standards before getting their license, only 10-20% at best would ever make it, and accidents would be so rare that fender-benders would make the news. Roads would be extremely safe, the automobile industry would crumble, and mass transit would be the norm, rather than the exception.

  10. Re:umm on Tim Bray on Implications of OpenDocument Format · · Score: 1

    Ogg codes for WMP. http://www.illiminable.com/ogg/

  11. Re:No, it's no on SSH Claims Draw Open Source Ire · · Score: 2, Insightful
    if said open source requires an $80k/yr person...

    Sounds like I need a raise.

  12. Understand how it will be used on Federal Agencies To Collect Genetic Info · · Score: 1
    Most of the public probably recognizes that the government ALREADY stores a somewhat reliable form of biometric identification whenever they haul anybody in for any reason--I'm referring, of course, to fingerprinting.

    People associated (for whatever reason) with law enforcement probably recognize the concept of having your prints "on file." The same sort of principle would apply with having your DNA "on file." The use of the registry would very likely be all the same stuff. So instead of just trying to look up the bad guy's prints, they'll be able to look up the bad guy's DNA.

    And as scary a concept as this is for privacy advocates, it really is a logical (if not inevitable) next step beyond "printing" people taken into custody. The results of such will most likely be largely positive--fewer bad guys go free, fewer good guys get falsely convicted (or even arrested).

    The bad news is that abuse of such a registry is also inevitable. Any large registry of data that is (a) widely trusted, and (b) not well understood, is bound to claim its fair share of innocent victims. That's unfortunate. While, for most of us, it makes our lives much better, for an unfortunate few, such a system would unjustly turn society against them.

    For example, an innocent bystander could be falsely linked to a crime scene just by brushing up against the perpetrator 3 days earlier in a different city. While that's not a problem as long as the police (and more importantly, a jury) takes that factor into serious consideration; knowing how people work, especially when under pressure, it would be unreasonable to expect people to be so ..um.. reasonable.

    The question is, is society as a whole better off or worse? Will the few misuses of the system be so grevious as to offset the benefit? The injustices that happen every day within our society that could be solved by such a system generally rival, if not exceed, the severity and quantity of any forecasted misuses. A lot of really bad things currently happen to good people. At least some of that could be stopped.

    So are we looking a a net gain or loss? That's really the question those voting on this should be asking. If a portion of our population is forced to surrender some additional degree of privacy to benefit others, is that acceptable?

  13. Re:Good encryption or not.. on Skype Security and Privacy Concerns · · Score: 1
    Good encryption or not, I'd be more worried about the recent moves of the FCC to allow law enforcement virtual wiretap access.

    The FCC considers skype an instant messanger service that happens to do voice. Hence, 911 and wiretapping laws do not apply.

  14. Re:I dunno on Hydrogen Generating Module to Help Your Car? · · Score: 1
    I noticed that too. 65% of the raw fuel is NOT expelled out the back. I believe most cars are over 99% efficient at burning the fuel, just 35% at turning that burn into the motion of the crankshaft (ie: waste heat, as you state).

    It was, at least, the case some fifty years ago that enough unburned fuel was expelled out the tailpipe that it became popular with the teenage hoodlums to put spark plugs back there and ignite the remainder of the fuel on its way out.

    I'm sure cars have become better at burning all the fuel, but the fact remains that a lot of energy is wasted as heat. In fact, a lot of energy is wasted trying to get rid of the extra heat.

    It would seem to me that a smart vehicle design would use the engine heat to power a secondary process that stores some of that energy away. Some sort of thermo-electric device perhaps? Use that to power an electrolysis reaction, and you end up with hydrogen! And there's a buzzword you can sell to a VC firm.

  15. Re:Oil Companies on Hydrogen Generating Module to Help Your Car? · · Score: 1
    We have been looking for something like this to put in our vaults never to be heard of again.

    Never underestimate the foresight of a multi-billion-dollar industry.

    While it's true that the oil companies profit off the existing technology (drilling, etc.), they often don't see themselves as "oil" companies, they see themselves as "energy" companies.

    Drilling and refining is a dying horse. While they fully intend to ride it into the ground, no one is more intent then they are on finding some alternate energy technology for them to base their bottom line on. They know they can't rely on wells for ever, and are anxious to get control of the "next big thing" -- not to bury it, but to make billions off it. Don't be surprised to see the hydrogen cars of the future filling up at Shell stations.

  16. Small company -- a dream job on Microsoft Employees Critical Of Their Employer · · Score: 2, Interesting
    But then again, my wife doesn't work at Microsoft, and she has expressed similar complaints about her past employers. So maybe it's more of a corporate America thing/large company thing, than a Microsoft thing.

    I never worked for MSFT, but I interviewed with them and turned them down to take a position in a small software-related service company. About 10 developers and 40 tech support guys, an IT supervisor, a couple of sales people, and a bigwig. It was definately the right choice.

    It's a challenge, and there's always something new and exciting for me to do. In the last two years, I've designed and built a high-availability server solution solution based in Linux, including writing all the server software, shell scripts, monitoring systems, etc. (no small undertaking). I've built a number of database interfaces using C# and .NET. I created a remote administration tool (admittedly based on free software :). I've created a web front-end to an application, done artwork with Photoshop, and have recently moved on to video/audio editing for marketing materials. And that's less than half of what's been on my plate in the past 24 months.

    If you haven't guessed, I'm the wildcard at my company. I do the jobs no one else knows how to do simply because I pick it up the fastest (and often becuase I volunteer). I feel very much appreciated at the office. My coworkers (and particularly my boss) are generally quite astounded by the depth of knowledge I have over such a wide range of topics, and the work I create is publicly admired and appreciated.

    This sounds like opportunities that you'd only find in a small company. What sort of corporation would lest on person such a wide variety of jobs?


    Well, contrast that with my wife. She works for a major retail corporation that I know you've heard of. She started as a seasonal employee, was promoted to department manager in 3 months, and in 2 years has been promoted so many times that her salary has more than trippled.

    She's an excellent manager and a very hard worker. She can motivate her employees to do twice as much as the company average, but with half the time and resources. And still her employees all love coming to work for her. On her own, she generally can do the work of about six people. Even early on, she had managed to accomplish so much with so little literally every manager above her paid her a vist to ask her about her methods--all the way up to the CEO.

    Now she has recently begun travelling about the country making the company a better place; fixing broken methods, motivating employees, and creating innovative soulutions to difficult problems. What she does in her job is kind of similar to what I do in mine, but transposed to a retail environment on a corporate scale.

    So what's my point? Well I think it's all about attitudes and people (particularly you). A lot of people who work at my wife's company hate their job. Typical "corporate America" attitude. My wife started at the very bottom (not even a "real" employee). But she became an expert in everyone else's fields by volunteering to do their work for them; just because she thought it would be fun to do. She then shot up through the ranks so fast that only corporate policy kept her from being promoted faster.

    I think there are a lot of companies that are just plain bad. When brilliant and innovative minds feel trapped, your company can sink no lower. However, the majority of the time, the problem is that most people are dumb, and most people are lazy. Whatever side of the fence you're on, it takes a lot of intelligence to recognize a brilliant solution, and it takes a lot of brilliance to create something intelligent.

  17. Re:I think it's a great idea on A Gimp In Photoshop's Clothing · · Score: 1
    The only reason I don't use the gimp is because I can't be bothered to learn a new interface.

    This is an absolutely critical issue that Gimp developers are too stubborn to recognize. They insist on creating a difficult user interface, and denying all evidence that shows what they're doing is wrong. They insist that their interface is better for various reasons--most of which are crap when it comes right down to it, due to one simple fact:

    The key is that an easy to use interface does exactly what the user expects it to do, not necessarily what's logical, connected, simple, or well-researched. And with the absolute ubiquity of photoshop in the area of graphic design, anything that departs significantly from Photoshop's interface (for whatever reason) is ipso facto difficult to use for the majority of its potential users. Plain and simple, no room for arugment. Cite whatever usability studies you want, but you're never going to get more than a marginal user base unless the majority of potential users thinks you have an easy-to-use program.

    The Gimp is the quintessential example of this issue: great program, radically different interface, and users are BUYING its competitor by the truckload rather than save hundreds of dollars and have to deal with the Gimp's interface.

  18. General Patent License on CA Releases Patents to OSS · · Score: 4, Interesting
    Actually, I see a real opportunity here. CA has granted you irrevocable license to use their patented software technology if (and only if) you release your implementation under an open source license.

    It would be very cool to see another clause saying that organization wishing to take advantage of this patent protection must also license all of their software patents under the same (or compatible) terms.

    Rather than taking RMS's short-sighted "no patents at all" approach, the GPL could use patent protection the same way it uses copyright protection to incentivise developers to open-source their software (and patents).

    Such an apporach would give open-source software a huge advantage over its proprietary counterpart: not ony would OSS developers get access to a vast selection of source code, but they would have royalty-free access to use certain techniques that would otherwise not be allowed. This could have a very strong viral effect beyond the power that the GPL currently wields.

    If RMS could have fought against copyright protection, he would have--after all, "information wants to be free," right? Lacking that option, he used his own copyright protection to force others to willingly give up their own. Software patents are a reality. Rather than fight impotently against the ideal, we ought to harness that protection to further the open-source cause. The earlier it takes hold, the more powerful the move will become.

    I rather like the idea of the FSF patenting its more clever ideas to prevent them from being used by closed-source developers. Right now OSS makes it easier to develop open source, the effect would be better if they also made it harder to survive developing closed source software.

  19. Easy ban lists on Blocking a Nation's IP Space · · Score: 4, Informative
    Want to know all the subnets a given country (in APNIC) uses? How about 3 lines of perl:

    $ctry = shift || 'cn';
    $_ = `GET http://www.apnic.net/apnic-bin/ipv4-by-country.pl? country=$ctry`;
    print join "\n", /([0-9\.]+\/[0-9]+)/g;

    My philosophy is that you should get to decide who you want to talk to. If you don't want to talk to anyone in China (or Australia, or whatever), then no one says you have to.

  20. Re:Yeah, but is it robot controlled? on Japan Plans Test of 'New Concorde' · · Score: 4, Interesting
    I find it amazing that jets like the 747 don't have a way to detect a loss of cabin pressure and go to a lower altitude.

    The technology is there, but they decided that it's safer not to implement it that way. Sensors do alert the pilot if the cabin pressure exceeds safe levels, but the plane never takes control away from the pilot.

    Consider the facts:

    • The highest "safe" (i.e. allowed) altitude without pressurization or oxygen is 12,500 feet.
    • Mountain peaks are often thousands of feet above that level.
    • Pilots have ample time (i.e. useful consciousness) to put on their oxygen masks in the event of depresurization. (Ever been in an aircraft that depressurized at altitude? I have. There's time.)
    • If the plane is flying so high that the pilot won't have plenty of time to assess the situation and put on his mask, one of the two must wear his oxygen mask at all times.
    • In the event that some major system on the aircraft malfunctions (like the pressurization system), the chances of another system malfunctioning because of some related damage are higher. In that case, having the aircraft make course adjustments on its own without the pilot's input could cause even more disasters.

    All things considered, the existing system was deemed the safest. We may never know the full details of the recent crash in Greece, but we can be sure that there was more to the story than just that.

    That being said, I would also point out that there is some merit to your argument. There have been enough crashes like the one in Greece to warrant further investigation--yes, it has happened multiple times that jets have depressurized and flown on autopilot until they run out of fuel. And in some of these cases, fighter jets have intercepted these craft in the air and found things like frosted over windows and a fully unconscious crew. Spooky.

    The technology exists (though, admittedly not in the older 737s). Modern civilian aircraft can navigate between any two points on their earth avoiding terrain and reporting their location and status to ATC, all without pilot intervention. If the airport and aircraft are properly equipped (most aren't), they can even land unassisted by the pilot. But while we tend to tolerate some degree of human error in almost everything, if some undamaged computer or mechanical component fails to perform adequately, inquiries and lawsuits always follow.

    The equipment to do all this is frighteningly expensive, but available. It's reliable, but not foolproof. But then again, the same goes for a human pilot.

    So is it worth it? I don't know.

  21. Re:Short and long answer. on GSM and Asterisk Integration? · · Score: 1
    while it's perfectly OK for you, as a lone individual, or a company, to operate a GSM handset, operating a base-station is another thing.

    While running a renagade cell tower isn't generally a viable option, if you command enough clout (i.e. a professional reputation and enough potential users) you can convince an existing cell carrier to put up a cell station on their network for your own private use.

    For example, Verizon put a cell station in an underground data center where I used to work. There would never be more then 10 people connected to the station at a time, so I'm sure the hardware wasn't any more complicated as what you'd attach to your PBX. The data center may have even paid for the hardware, but the cell phone company happily provided the connectivity.

    Normal usage charges apply, of course.

  22. Re:Obvious question on Firefox Hits 80,000,000 Downloads · · Score: 1
    ...how many of those downloads are unique users, vs. prior users downloading a new version?

    Well, I know I'm responsible for at least 15 of those downloads.

  23. Re:Unnecessary on RFID Tags in Law Enforcement · · Score: 1
    RFIDs can be swapped.

    This is an important enough point that it bears some expansion. If all they do is check RFID tags on the way in our out of the country, at best all they're logging is the entry/exit of someone's passport (or similar other documents). That proves nothing at all.

    To complicate things, RFID tags are not necessarily permanantly attached to anything. There's no real guarantee that your passport even left the country. It would be a lot like putting a gold star sticker on someone's papers, and then "tracking" that person just by looking for the gold star.

    Naively optimistic to say the least.

  24. Re:"security researchers" is a broad rubric on Oracle's Chief Security Officer Speaks Out · · Score: 1
    One of the continuing problems with IT security is the fact that the bright folks who can find or fix problems aren't always the ones who understand how really big, clunky corporations work. The only goal in the article there is to do discourage people from doing the whole "I found a vulnerability, you have 5 days to comply" nonsense.

    Not everything happens slowly in a large corporation. If a company finds out that a flaw in their billing procedures is causing the loss of $3m per day, that flaw will be fixed within the hour--legal department be damned.

    The goal of this "nonsense" that the security researchers are doing is designed to train these corporations to treat security flaws as a stop-the-press sort of emergency. At the moment, security fixes often go through the same channels as spelling errors and other minor bugs. The truth that these corporations don't want to face is the fact that product they've shipped is defective and dangerous, requiring an immediate recall, not a filed bug report.

  25. Re:Zealotry is bad, no matter who does it on Rackspace, Indymedia, and the FBI · · Score: 1
    Indeed. If I were a Rackspace customer, I'd be looking for a new host right about now.

    Been there, done that. Server Beach is a great RackSpace alternative. Support resolution time goes up from a few minutes to maybe a half hour, but the cost is cut in half.