Slashdot Mirror


User: tlambert

tlambert's activity in the archive.

Stories
0
Comments
5,097
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 5,097

  1. Re:Can someone remind me, please... on Greek Banks Under Cyberattack, Face Ransom Demands (ft.com) · · Score: 1

    Can someone remind me, please... why do banks need web sites, when there are ATMs everywhere?

    So I can manage my money without having to go to an ATM?
    Also. it's a whole lot easier to set up automated payments for a biller when I can type the biller's info on a full keyboard.

    You mean like the ones they have at your local bank branch?

    Or are you arguing that a convenience is worth paying the ransom on your account?

  2. Re:Why are we not funding this? on Washington Hosts Summit On Gene Editing and 'Designer Babies' (washingtonpost.com) · · Score: 1

    And when there is an "oops", and your grandkid grows a 3rd eye?

    Then the entire family never has to work again over the proceeds of the lawsuit, and little "Blinky" becomes the most revered member of the family, for time immemorial.

    Not seeing a problem, here.

  3. Can someone remind me, please... on Greek Banks Under Cyberattack, Face Ransom Demands (ft.com) · · Score: 1

    Can someone remind me, please... why do banks need web sites, when there are ATMs everywhere?

  4. Re:Two words on Peter Thiel: We Need a New Atomic Age · · Score: 1

    First of all, who cares how much money he made and how much I make.
    I don't even know who that guy is.

    Secondly: I'm not arguing about him or his ideas but about my parent who wants Germans and Swiss and other water rich countries to switch back to nuclear power, to desalinate water when they have excess power.

    Hint: Switzerland has not een access to salt water!

    OK, then power a free public transportation system with the excess electricity. The point is, you can always find uses for extra electric power; I know what the vast majority of the world would use it for, even if you wouldn't use it for the same thing.

  5. Re:Two words on Peter Thiel: We Need a New Atomic Age · · Score: 1

    Call me back when you've made as much money from your ideas as Peter Thiel has made from his.

  6. Re:Levels of Security on IoT Home Alarm System Can Be Easily Hacked and Spoofed (cybergibbons.com) · · Score: 1

    I'm not going to write an entire paper here on Slashdot.

    You already kind of did lol. This is good stuff though. I have some follow-up questions if you don't mind:

    1) How are you aware of (and able to control) lower-level things like the page size, or which functions go into which groups of pages?

    In a general, hand-wavy fashion, things like page size are an attribute of the compilation environment, and do not vary.

    In practice, there are some older MIPS systems and the original NeXTStep which would "gang" 4K pages into 8K pages, and of course there's the Intel variety of superpages, depending on operating mode and contents of CR4, and the PSE bit being set, with or without the PAE bit being set, to give you either 4M or 2M pages. There are also some other architectures that allow even weirder variants.

    As a general rule, most of these things other than the default are accessed via two interfaces: Either a section attribute in an executable section descriptor -- meaning it's handled by the kernel -- or via a special user mode interface for allocating large pages. The user mode interface may or may not be hidden in the malloc internals, in order to prevent direct use by a program. In addition, there are potentially device specific controls (in UNIX systems, these would be ioctl's) to map large pages into a user space process; as an example, the frame buffer memory in a Wayland or X Server, and so on.

    Practically speaking, one of the most useful things you can do with large pages in a Linux, BSD, or UNIX running on an Intel system is to put the kernel itself into large pages; location won't matter, without a kernel code injection exploit. It's useful because Intel processors maintain separate TLBs (Translation Look-aside Buffers) for large and small pages, and this means that user space processes, and kernel interrupts, traps, or traps from user space to kernel space (e.g. system calls) won't be ejecting each other's pages from the look-aside. Depending on how frequently you end up running in the kernel vs. user space, this can result in an up to about 36% performance improvement.

    One of the problems with this is that there's a known bug in Intel processors where INVLPG won't invalidate the page mappings in both, so there was an early bug that tended to hit Linux systems -- but not FreeBSD system -- where the INVLPG instruction kicked a page out of one TLB but not both TLBs, if it was mapped in both. This was mostly an issue when you tried to convert from running in real mode to running on the PMMU, and then from there, from 4K pages to large pages. The work around is to INVLPG twice, or to reload CR3, which flushes all the TLBs (making it the "big hammer").

    Anyway, that was a digression, and in the scenario I discussed using statistical protection, you'd use the compiler and linker to make sections per function or function group, and then the linker would put linkage vtables in each of these groups when creating the executable, and then the exec function in the kernel would interpret these as allocation units, and put the sections in as few contiguous pages as possible, and then randomly locate them some place in the process address space. Which on an Intel/PPC architecture would locate them in a 64 bit virtual space, out of a 52 or 53 bit physical addressable space.

    When the loader resolved the linkages for shared libraries through the fault/fixup mechanism, it'd do it by library:section, rather than by library alone, using the per-section vtables.

    2) Why is it called "container-in-a-mailbox?"

    Fair question.

    Historically speaking, there are several ways to pass things around around between components. One of these is via register reference to the address of the thing. Another is via stack reference to the address of the thing. Another is via descriptor (in VMS, this is the function descriptor; in Mach, this is a Mach Message that is defined in an IDL co

  7. "based in Longview, Texas" ... on Sued For Using HTTPS: Companies In Crypto Patent Fight (theregister.co.uk) · · Score: 1

    "based in Longview, Texas" ... that kind of says it all, doesn't it?

  8. Re:Levels of Security on IoT Home Alarm System Can Be Easily Hacked and Spoofed (cybergibbons.com) · · Score: 1

    btw, I'm pretty sure you have an interesting point here when you said this:

    Functional decomposition is a really poor way of abstracting complexity, when it's being used in isolation, and does not include mandatory boundary layer order and direction of operations over said boundary.

    but I'm not entirely sure what you meant. Could you clarify? What other option is there besides functional decomposition?

    DJB's philosophy is to minimize individual attack surfaces by reducing code complexity. This has three components, of which DJB himself is a proponent of two of them. I'm not sure whether this is because he doesn't realize that it's a consequence of his implementation paradigm, or whether he simply thinks it's too obvious to talk about. These are the components:

    (1) Reduce complexity by separating the problem domains into individual processes. This separates necessary privilege escalations from other code, and separates cross-functionality address space based attacks on the code.

    (2) Reduce complexity into functional time domains involving serialization of operations which could (potentially) otherwise take place in parallel. This is also done through use of individual processes, but is based on the trigger initiating the processes being separate, and therefore not under the control of an attacker. This increases the difficulty of an attack by requiring serial attacks for each component between the intermediate targets and the final target of an exploit (as in the previously referenced "shellshock" attack). For a shellshock attack, this particular precaution was meaningless, since there was a direct passthrough of the data without prevalidation without action before passing the data onto another component. In other words: the particular attack zips through this security precaution.

    (3) This may or may not have been intentional, but he reduces the network and system call footprint for each of the components in such a way that it reduces the remotely accessible attack surface (you can only attack things you can talk to) to something which can be firewalled, and the system call footprint of individual components into something that could have local application sandboxing applied to prevent particular system calls being used by individual program components, or even sequences of system calls being used outside a particular order, or in excess of a particular number of times. This was probably not a design goal, given that neither deep packet inspection/stateful firewalls, nor sandboxing, were utilized in most systems at the time qmail was originally written.

    That's cool and all, but it's taking a hammer to a problem which is actually a result of programmer discipline and machine architecture, and, frankly, some of those architecture issues have been addressed at the operating systems and compiler level for years, and others are better addressed through other mechanisms. It also failed miserably in intentional strategy #2, above.

    The first mechanism is boundary layer violations. The most infamous email program in existence is Microsoft Outlook, and it's for good reason. Outlook engaged in interface layering violations. These are responsible for nearly all the initially exploited Outlook vulnerabilities.

    What avoiding boundary layer violations means is that, if you are designing correctly, you identify architectural layers for your libraries in order to abstract complexity of each layer from the layer below it. As part of this, you define an interface contract: you are permitted to call down to the interfaces below yourself, and you are permitted to call across, within the same layer to auxiliary functions, but under no circumstances are you permitted to call upward. A good example of a boundary layer violation in libc is the use of a function pointer for the compare function in the qsort library routine, which will result into an upcall from the libc layer, to upper level code. In general, this should

  9. Re:I really wonder how other employers/employees.. on Contractors or Not, Seattle Uber Drivers Might Get Collective Bargaining · · Score: 1

    In the cases I have seen "contractors" have all been W-2s I should move to your part of the country, I hate being a W-2

    The easiest way to accomplish this is to start your own contracting agency, and then employ yourself, and any friends who are in the same boat, as a 1099 worker. The bonus is that this will let you deduct most of your taxes as either "operating expense" or "capital outlay" on the part of the agency, you can run an expense account for most of the day to day expenses, including a car if you want, you can incorporate retirement fund operating company for the contracting agency to reallocate income into for the principals in the contracting agency, and you still get your 1099 job on top of it.

    BTW: This is how most massage studios, day spas, nail salons, hair salons, and so on operate. Everyone who does the actual work is a 1099, with the exception of the owner, and maybe a hourly receptionist, if the business is big enough to merit one for bookings.

  10. Re:Levels of Security on IoT Home Alarm System Can Be Easily Hacked and Spoofed (cybergibbons.com) · · Score: 1

    Actually, it has been hacked, and it's relatively easy to do.

    [citation needed]

    http://marc.info/?l=qmail&m=14...

  11. Re:Two words on Peter Thiel: We Need a New Atomic Age · · Score: 1

    I'm normally not this rude, but I'm feeling a little put off by you, so I will take my gloves off this time to set you straight.

    A few facts for you idiot.

    Sure, fucktard. I'm listening.

    1) Californias water problems are house made and not solveable by desalination plants, I doubt they would ever be economical in relation to just start with 'saving water'.

    Adding together all the water savings every year since the conservation programs began over 20 years ago, you get slightly less than the 5 *billion* gallons a day which are used in the Sacramento Valley *alone* for growing rice for export, to cover evaporative losses from the paddies.

    Or, you know: you assholes could grow your own food, since almost all that rice is grown for export.

    Or you could build some reservoirs, but well, that would involve the government, needs tax money, god forbid the government actually doing something for the people.

    Reservoirs interfere with the mating cycles of fish, and in particular, Pacific Salmon, but also with a number of endangered species.

    While I think it would be great for the people in Los Angeles to get off their collective Hollywood asses, and build some cisterns, instead of directing all their rainwater runoff into the ocean, that would only make a small dent in the problem, since the primary problem is that California grows about 1/5th the food eaten in, and *exported from*, the U.S., and uses a lot of agricultural water to do it.

    By the way: it's the same people who care so much about the fish that they are actually tearing down reservoirs and dams to save their habitat, who are violently anti-nuclear power.

    2) Germany is a net exporter of energy, allways was and likely allways will be. That includes for most of the time France, there are only a few months in a row in 2013 or 2014 where we where a net importer versus France. Germany is exporting 30% - 50% of its energy production to the EU, you idiot.

    See, that used to be true when you were running nuclear plants, but according to this Bloomberg article, that stopped right after you idiots shut things down after the Fukushima disaster because, you know, all your plants are in coastal areas subject to tsunamis, and you stupidly did what TEPCO did, and failed to upgrade sea walls and safety systems.

    Oh wait. Your plants aren't actually in any danger from this.

    Why did you idiots shut them down again? It's hard to believe that a country that birthed nuclear physicists of the like of Einstein and Heisenberg would be quaking in their boots over a problem in Japan caused by greedy middle management.

    http://www.bloomberg.com/news/...

    3) look on a damn map. How retarded can one be and claim that Parkistan is using 'thermal waste to desalinate water' ... and why should they? Again, look on a damn map where Parkistan actually lies.

    "Pakistan has a 1,046-kilometre (650 mi) coastline along the Arabian Sea and the Gulf of Oman in the south"

    I thought Germans were supposed to be good engineers. You are also aware that desalination is a generic term for water purification from various impurities, and can be applied not only to sea water, but also to well water, and waste water from other sources, right? Not that Karachi isn't on the freaking Arabian Sea anyway, as opposed to being land-locked, like you are trying to imply.

    http://www.world-nuclear-news....

    P.S.: Yes, that desalination plant was subsequently built at the Karachi nuclear facility.

    4) The efficiency of pumped storage and lithium ion batteries is more or less the same, no idea why you disagree about stuff

  12. Why is everyone trying to sell me a bridge? on IoT Home Alarm System Can Be Easily Hacked and Spoofed (cybergibbons.com) · · Score: 1

    You, Sir, appear to be in dire need of a bridge. And it just happens to be your lucky day. I have a terrific one for sale, for a very reasonable price indeed!

    Why is everyone trying to sell me a bridge? The specification clearly calls for a switch...

  13. Re:Levels of Security on IoT Home Alarm System Can Be Easily Hacked and Spoofed (cybergibbons.com) · · Score: 1

    I'm quite tired of the hi-tech this-security-is-hackable discussion. Of course it's hackable. Everything is.

    If you think so and can prove it, then you can earn $1000 and eternal fame by hacking DJB's qmail. Over 15 years and still hasn't been hacked.

    Actually, it has been hacked, and it's relatively easy to do.

    Functional decomposition is a really poor way of abstracting complexity, when it's being used in isolation, and does not include mandatory boundary layer order and direction of operations over said boundary.

    I really don't need to spend $1,000 worth of my time to argue with DJB, when he'll happily argue with anyone for free.

  14. It's because it's Pakistan asking. on BlackBerry Exits Pakistan Amid User Privacy Concerns (blackberry.com) · · Score: 2

    It's because it's Pakistan asking. They had some qualms when India first asked, but granted them access eventually.

    http://thenextweb.com/asia/201...

  15. Re:I really wonder how other employers/employees.. on Contractors or Not, Seattle Uber Drivers Might Get Collective Bargaining · · Score: 1

    The contractors they use are corporations which provide workers who are W-2 employees of those corporations. A true contractor is an independent 1099 worker who set rates, covers their own healthcare, retirement, etc. Don't confuse the two.

    I don't. The contracts we dealt with at IBM and Apple, and the contractors I've personally dealt with in the context of Microsoft and HP, were all 1099 workers.

    While I've dealt with contracting corporations in the service industry as well, most of the people who fulfilled the contracts were doing piecework as 1099 contractors, and not full time employees of the contracting corporation. In this context, I'm referring to "temp reps" (for sales), and traditional temp agencies for seasonal work, or to bolster e.g. accounting or HR departments during "flash mob" situations (accountants brought on as 1099 contractors for audits are a good example of this).

    Most things like forensic accounting or private investigation for law firms are run on billable hours. Most law firms which do not operate on a retainer or contingency fee basis, are also contractors. Generally, in Silicon Valley, you'll see a lot of outside law firms brought in to prosecute patents (for example) after vetting by in house counsel to ensure that the boiler plate on the application, and the claims, are more or less correct.

    When I was tech lead for the UNIX Conformance project at Apple, we had four contractors, all 1099 workers: one for man pages, one for some of the user space work, one to run the tests, and one to do the compiler conformance work on gcc. We ended up hiring two of them full time, later on, which is something which we couldn't have done, if they were employees of a contracting agency.

    In fact, I have to say I've personally only interacted with an agency at one point in time, and that was at IBM. The agency was contracting a worker to IBM that was in the U.S. on an H1-B visa, and the contractor whose services were being provided to us had to have a placeholder to act as the sponsor for the visa as a means of (eventually) getting a green card. Generally, I've only seen contracting agencies use either 1099 workers themselves, or they employ H1-B workers who have to have a business sponsor them, without actually having a job at one business long enough to deal with the Green Card process (although you can get a Green Card in about six months, if you do the things, like medical, in parallel with all the other steps that can be done at the same time).

  16. Re:Two words on Peter Thiel: We Need a New Atomic Age · · Score: 1

    No idea where you live that you obviously need desalination plants.

    California. Not an island nation. Irrigation for food takes a lot of fresh water. So does industrial processing for a lot of things. So do people.

    A lot of countries run desalination. Pakistan uses thermal waste from their nuclear plants to run several desalination plants.

    Since Germany was one of the countries mentioned, you should not that they are a net power importer, primarily from French nuclear plants, due to having shut down their own nuclear plants.

    I don't think it matters if you just waste the electricity -- although if you have a hydroelectric infrastructure, you can use hydroelectric dams as storage batteries by using the otherwise unused nuclear generated electricity at night to pump water from low storage dams, back into the higher level storage dams that were used during the day to handle peak load.

    Use of hydroelectric dams as storage for electricity this way has a significantly better KWh efficiency than, say, Lithium batteries, and balances out the demand load very nicely.

  17. Re:Two words on Peter Thiel: We Need a New Atomic Age · · Score: 1

    Two words: Desalination plant.
    Extremely useful in Germany, or the Netherlands, or *cough* *cough* Switzerland.

    If only those countries had neighboring countries into which to sell excess power, or to which to sell water. Sadly, they are island nations, right?

  18. But ... but ... but! on VW Officials Knew Since Last Year of Misleading Fuel Economy Claims (reuters.com) · · Score: 1

    But ... but ... but! We just threw a couple of perfectly good scientists and engineers under the bus!!!! You mean we did that for NOTHING?!?!?

  19. By watching if it changed orbit.

    You have just answered your own question: it changing its orbit *IS* it communicating with you. It's the minimum bandwidth unidirectional data channel.

  20. Re:I thought the secondary payload on NASA Prepares To Launch an Orion and 3 Cubesats To Deep Space: 3 Years To Go (examiner.com) · · Score: 1

    And of course, no one is inspired by the idea of building autonomous robots to explore an alien world. That stuff is just mundane.

    Once the robot is built, your job is done.

    You don't build autonomous robots in order that you may explore an alien world, you build autonomous robots in order that the autonomous robots may explore an alien world.

    Once you launch the things into space, you might as well be watching "Duck Dynasty" or some other form of reality television.

  21. I really wonder how other employers/employees... on Contractors or Not, Seattle Uber Drivers Might Get Collective Bargaining · · Score: 1

    I really wonder how other employers/employees are going to take this.

    The Seattle areas top ten employers all make heavy use of contractors:

    1. Boeing
    2. Microsoft
    3. University of Washington
    4. Amazon
    5. Weyerhaueser
    6. Group Health Cooperative
    7. Fred Meyer
    8. Bank of America
    9. Qwest Communications
    10. Nordstrom

    Good luck with the lawsuits guys! You're going to be getting it from both side, if this passes!

    Side A: The employers who provide all your jobs, and don't want to have to give up contract workers
    Side B: The contract workers for those employers, who wonder why Uber contractors deserve your intervention, but they don't

  22. You *do* realize, right... on Contractors or Not, Seattle Uber Drivers Might Get Collective Bargaining · · Score: 1

    And Workman's compensation suffers an economic loss when employees are falsely called independent contractors.

    You *do* realize, right... Workman's Comp is not supposed to be a profit center for the state, and that because contractors who do not pay into it can not make claims against it, you're only counting a lack of revenue from taxes as them suffering a loss, and they aren't suffering an actual loss in terms of having to pay out funds that they did not collect in the first place?

    I know that many states treat it as a slush fund they can borrow against, and (effectively) never pay back what they;ve borrowed out of it, in the same way the federal government borrows from the social security trust fund. But it's not actually *supposed* to work that way.

  23. Re:I thought the secondary payload on NASA Prepares To Launch an Orion and 3 Cubesats To Deep Space: 3 Years To Go (examiner.com) · · Score: 1

    What inspired engineers before space?

    Science fiction for some of it. The rest was patriotism and the existence of the Cold War with Russia fueling a need for better tech than the Russians had, so that we could kill them before they killed us.

    You probably do not remember Nikita Khrushchev pounding his shoe on the table at the U.N. in 1960, shouting "We will bury you!".

    https://www.youtube.com/watch?...

  24. I thought the secondary payload on NASA Prepares To Launch an Orion and 3 Cubesats To Deep Space: 3 Years To Go (examiner.com) · · Score: 2

    I thought the secondary payload was called "astronauts".

  25. Two words on Peter Thiel: We Need a New Atomic Age · · Score: 1

    Nuclear and coal have this large problem that they are unable to adapt to demand variation. Instead they just waste the overproduced energy as heat.

    Two words: Desalination plant.