Slashdot Mirror


User: ancientt

ancientt's activity in the archive.

Stories
0
Comments
703
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 703

  1. Re:my prayers go out to my fellow nerds at IBM on Massive Layoff Underway At IBM · · Score: 5, Insightful

    Thank you for some perspective. I've been reading the other posts and I've been just a little disgusted by the entitlement attitude throughout. I've worked for a company that went under, worked for a division that was eliminated, worked for a company that couldn't pay me for a while and been fired for problems that weren't my fault (that's four different employers.) It sucks, but none of them owed me a job. I'm not owed a job even now when I feel I'm doing great work for the company that employs me.

    I was very close to writing a snarky post.

    Your comment reminded me how much it sucks to wonder how you're going to get by, what you're going to do to take care of your children and if you'll ever get back to where you were. IBM may need to do this; they've been slowly building to an implosion for decades. I'd love to have IBM come back. I root for companies that can come back from the brink of oblivion, like Yahoo is, like Microsoft is trying to and like Radio Shack has failed to manage. I hope that in ten years, when my children are telling me about how cool IBM is, I'll be able to say that there was a time it looked like they were doomed before they turned it around however painfully.

    To those who have to find new jobs, I add my heart goes out to you and I hope I get to work with you some day when we can both look back on this as a point when things started to get better.

  2. Re:Internet Explorer on In Addition To Project Spartan, Windows 10 Will Include Internet Explorer · · Score: 1

    Yeah, I know, that's funny and yes, for a good three seconds, I had a moment of incoherent and dumbfounded shock at the idea someone could be seriously saying that. Then I saw the moderation and realized I'd been had. I paused for a second and realized I had some actual experience that wasn't so far off.

    There was a time I liked VMWare. I used it until I discovered how much better Xen performed for me. I was a fan of XenSource until they were taken over by Citrix. When I took a job with Microsoft as the standard (no kidding, the boss sat me down and gave me the lecture my first week for daring to use VNC instead of MS Remote Desktop) I learned to use Microsoft virtualization instead. This was before Hyper-V and it.. well lets just say it was a hard acclimatization, so when I needed something that actually worked well, I convinced them that VMWare was a big enough enterprise player that we could use it where MS just couldn't do the job. That didn't mean I got a budget of course, it just meant I could use the free version. It wasn't great, but it was good enough. IE worked with it but keeping IE patched meant that IE stopped working, so now I had a system that couldn't work with anything but outdated and insecure software. Long story short, until I retired that system years later, I had portable Firefox 2 to run the interface.

    I still don't love Hyper-V but it has performed better than VMWare free crap and if it still doesn't do some things (seriously, when will they enable USB access for clients?) at least I don't have to keep ancient browsers around to manage it. I miss Xen and still don't think KVM is as good. For that matter I miss the Phoenix browser. The best thing that could have happened to the Mozilla browser was to throw away all the crap that kept it from doing the one thing it was supposed to do best. I will appreciate it if Spartan is even half the improvement Phoenix was over Mozilla. I won't be surprised to write a comparison on how both started out with noble goals and decent performance before they were killed by the same loss of focus by their parent company in ten more years.

  3. Re:Poor choices to use proprietary cause this! on Google Researcher Publishes Unpatched Windows 8.1 Security Vulnerability · · Score: 1

    Why are you bringing up the average user when he was talking about the end user who has a strong reason to keep something patched? That's comparing a Mint home user to someone running the distribution upgrade servers.

    If you are in charge of managing an important system or network, then you can either fix the problem yourself, have your programming team fix it and commit the fix back to the upstream vendor or you can potentially hire the work out. Even if you are an average end user, you could actually fix it if you were willing to put in the work, however unlikely that scenario might be.

  4. Re:This is why "biometric" authentication is usele on Chaos Computer Club Claims It Can Reproduce Fingerprints From People's Photos · · Score: 1

    As for remembering, is it harder to remember "username" and "password" or "usernamepassword"? It's the same. You just don't press return in between them.

    Logically? No. But in practice, I support both approaches and yes, for no obvious logical reason, it makes a huge difference.

  5. Re:lemme guess on Norse Security IDs 6, Including Ex-Employee, As Sony Hack Perpetrators · · Score: 1

    Some certainly do and that bothers me. It shouldn't be that hard to set the MITM proxy to reject invalid certificates and provide the reason for the rejection to the users, but I haven't seen it done right.

  6. Re:lemme guess on Norse Security IDs 6, Including Ex-Employee, As Sony Hack Perpetrators · · Score: 1

    You think Sony did?

    I doubt the value "most" in your statement.

  7. Re:This is why "biometric" authentication is usele on Chaos Computer Club Claims It Can Reproduce Fingerprints From People's Photos · · Score: 1

    How is 8 letters username + 8 letters password harder or easier to crack than a 16 letters password?

    It isn't easier to crack, but people remember usernames easier, so you get people who will enter 16 characters instead of eight. The validating server can treat them as separate lookups or not without impacting the efficiency of brute force attacks. The advantage of using multiple entries is that you end up getting more characters that have to be guessed correctly, which is a compound effect, so adding a PIN or multiple choice question compounds it further and isn't pointless at all.

    Say you are trying to brute force my slashdot password and it's eight characters. That's 7213895789838336* possible combinations you have to work through to target one user, but I'm user 166417, which means you'd be 166417 times more likely (at least) to get illicit access if I weren't using a separate username.

    Now, if my username were hidden and combined with the password entry and had to be eight characters, you'd have 52040292466647269602037015248896 potential combinations, which is obviously harder to crack, but you'd sacrifice functionality for that trade off and 7213895789838336 is a reasonable number of permutations for the level of security required. In reality, I'm not limited to eight characters so the real number is even higher.

    Now, you have a valid point if you say that 16 characters would be a better length for passwords, but if you required that, there would be far fewer people who would sign in and make comments which would degrade the value of the whole system.

    * - I know there is additional math that can be done here, not limited to but certainly including the tendency of people to use words and pseudo words in their passwords. I've read the manuals and brute force cracking articles too but I'm not getting paid to figure it out so my motivation to get a more accurate number is low.

  8. Re:This is why "biometric" authentication is usele on Chaos Computer Club Claims It Can Reproduce Fingerprints From People's Photos · · Score: 1

    Interesting comment, can you point to any articles on the topic?

  9. Re:This is why "biometric" authentication is usele on Chaos Computer Club Claims It Can Reproduce Fingerprints From People's Photos · · Score: 1

    If we're talking about protecting against unauthorized access in the real world, we do want a username and password combination because that's harder to guess than just a password. If I am running a website where I'm using a cookie as part of the authentication process, then yes, it is best to keep a database where I tie the cookie to an IP address because that makes it harder to hijack a session.

    When I can force you to hand over one thing you know, I can force you to hand over two things you know.... that second factor would keep me out.

    Over and over you are stuck on this idea that you're defending against a physical attack, which is quite nearly pointless. The attacker who takes family members hostage will bypass pretty much any security you can put in place.

    If you're really wanting to discuss security against physical force, then you're not thinking big enough, why not discuss defending against the attacker with a gun pointed at your family member or a bomb in a school? Why not discuss defending against the attacking country with ICBM with nuclear warheads? Pick your action movie plot of choice, I'm willing to go down Diehard lane with you. I just need to make sure we're talking about the same thing.

  10. Re:lemme guess on Norse Security IDs 6, Including Ex-Employee, As Sony Hack Perpetrators · · Score: 4, Interesting

    You're making this too hard. You can upload terabytes of data using good old SSL or encrypt files with zip tools like 7-zip and there is nothing in the stream of data that will be recognized... that's what encryption is for.

    The person wanting to get data out doesn't have to work hard at all to ensure it can't be recognized as it is being transmitted. The difficulty is in making sure that the users of the system don't notice the decrease in disk IO and loss of bandwidth. If they've got a good perimeter defense or the right heuristics for the server, they may notice "hey, that's more activity than usual" and respond, but that's about the only way to catch somebody in the act of transporting data out of a system.

    Unless they're stupid. Which, with Sony's security, they could have been.

  11. Re:This is why "biometric" authentication is usele on Chaos Computer Club Claims It Can Reproduce Fingerprints From People's Photos · · Score: 1

    Soon we will be wearing, burkas, sun glasses and gloves to make sure our identities will not be lifted.

    No. Biometric authentication won't replace all other methods of security anytime in the foreseeable future, nothing that requires serious security will rely on them alone. I have a hard time believing they ever could. If any serious company tries anytime in the next twenty years, you have my advice to place bets that it will be compromised in short order.

    I keep seeing this idea that biometrics are flawed because you can't change them if someone's information is compromised, but that idea ignores the reality that biometrics are not and will likely never be used alone as significant security.

  12. Re:This is why "biometric" authentication is usele on Chaos Computer Club Claims It Can Reproduce Fingerprints From People's Photos · · Score: 3, Insightful

    Minor quibble: using two of one group is not useless either, it is only less useful.

    • Most login prompts require a username and a password, which are both things you know, but that combination is better than requiring only one thing you know.
    • Requiring answers to security questions, yet another thing you know, is often considered better still.
    • Iris scans can be faked as can fingerprints, but both together is harder to fake than either alone.
    • Bribing one guard is easier than bribing two.
    • Checking that a browser supplies a cookie is a good thing, but checking that the IP and the cookie are paired correctly is better.
  13. Re:This is why "biometric" authentication is usele on Chaos Computer Club Claims It Can Reproduce Fingerprints From People's Photos · · Score: 5, Interesting

    Not useless, just not sufficient.

    Your house key will work in hundreds of locks, but it's easier to pick the lock than track down exactly which house key might work on the house you want to break into. The reason that biometrics are useful is that they provide a second condition that has to be met for authentication, not because they provide the only one. If you give employees RFID cards and pair it with iris scanning, you're going to have moderately secure door security. It can get a lot better by adding other controls, for example introducing human checks into the system or an employee PIN.

    Most businesses don't even have a second check for door security. I wish people would quit confusing a method of authentication with the idea that any single method is sufficient.

  14. Re:Morons should read some economic history on Serious Economic Crisis Looms In Russia, China May Help · · Score: 1

    Could we maybe buy some more of Russia? It worked out pretty well last time.

  15. Re:Rise of the darksite DNS on Sony Leaks Reveal Hollywood Is Trying To Break DNS · · Score: 1

    You say that but maybe you won't be able to. When I was filtering the internet for my kids, I included an interception of anything on DNS ports and redirected it to my filtering server.

    Your ISP could do the same thing, fairly trivially and if they do, it won't matter what IPs you tell your machine to use as a DNS server, it will use the ISPs anyway.

    I think it breaks DNSSEC and I *know* it makes MITM easy for non-encrypted sites (because I did that too) but don't expect the MPAA and Sony to care, they're happy to break the security of the internet for everybody as long as it lets them think they're preventing copyright infringement. The ISPs would do it now to increase profit if it was worth the effort and complaints it would come with. Don't expect it to take more than a hint of government suggestion for your current freedom to disappear.

    Don't feel too bad for my kids, they're old enough now that discussing and spot checking their habits is a better solution and most of my active interference was to block them until they completed a chore each day.

  16. Re:Fire all the officers? on Once Again, Baltimore Police Arrest a Person For Recording Them · · Score: 1

    Looks like somebody else had a similar idea in congress.

  17. Re:Fire all the officers? on Once Again, Baltimore Police Arrest a Person For Recording Them · · Score: 1

    The problem here is that prosecutors and cops need to get along and need to trust each other and the public needs to see cops held to account for their actions. I am leaning toward "bypass the grand jury for public servants" as a solution to ensure that not only is justice done, but so that it is seen to be done.

  18. Re: Fire all the officers? on Once Again, Baltimore Police Arrest a Person For Recording Them · · Score: 1

    Or maybe the pension so there is peer pressure to not screw up?

  19. Re:Legal Opinion, Please? on French Publishers Prepare Lawsuit Against Adblock Plus · · Score: 1

    Well said.

    Customer: [turns off neon BEER sign in living room]
    Police: Hey, open up, we know you turned off the beer sign!
    Customer: Sure, so what? The electric company sent it over, but I pay for the electricity to power that thing and it was annoying.
    Police: Sir, you cannot turn off the beer sign because then you might not buy beer.
    Customer: I wasn't planning to buy beer.
    Police: Doesn't matter. The beer company got an injunction against having their signs turned off. Turn it back on and leave it on.
    Customer: That doesn't make sense! I shouldn't have to pay to power a sign I never wanted, this is crazy!
    Police: This is France.

  20. Re:Legal Opinion, Please? on French Publishers Prepare Lawsuit Against Adblock Plus · · Score: 1

    Thank goodness. For a minute there I thought browsing with elinks was illegal.

  21. Re:Bullshit ... on Is Public Debate of Trade Agreements Against the Public Interest? · · Score: 1

    By way of reference, I suggest you review the Founding Fathers' thoughts on slavery and women's right to vote and stuff.

    I think this is the real point and real problem. The founding fathers were creating a consortium of states with a minimal federal government and were trying to protect the freedoms they felt were important. I am lucky to have benefited from a society built on them, but our people now would never agree with our founding fathers' beliefs.

    • The people should be as well armed as the government
      • The right to bear arms was obviously about making sure they would be able to successfully rebel against the government. It wasn't that scary a thought to them because they didn't see the government as being that big or critical. The idea of citizens having the rights to nuclear bombs would be inline with what they were setting up, but nobody (sane) wants that so we (the courts and lawmakers) ignore the intent and interpret arms as guns.
    • Women weren't trustworthy and shouldn't be involved in running anything.
      • Giving them a right to vote took 142 years. We prevented that right longer than we've granted it.
    • Making someone a slave because of the circumstances they were born into was completely okay.
      • For that matter, as much as we want to treat them as if they were ultimately great men, Jefferson had a child with his slave. Which, since he had the right to beat her, sell her or even kill her without fear of the law, cannot be considered other than rape.

    That doesn't even touch on preventing the poor from voting.

    The blunt fact is that the Constitution of the US was quite useful and has allowed the formation of a successful society with one of the highest standards of living in the world. And it is flawed since it was written by humans who were also flawed.

    We should rewrite the Constitution from scratch around the beliefs we actually care about. We can't because we can't agree about anything and we'd have another civil war if we even tried. We can't even get anywhere near the point of being able to amend it. I for one wouldn't trust either party's representatives currently in power to do something nearly as successful for so long.

    The only way we could fix it would be to do the debate and drafting without informing the public. When something is done in secret, you can make deals, agree to give up one thing in order to get something you feel is more important. Maybe we'd see the right to a free press succeed because the right to marry someone of the same sex would get dropped. Can you imagine the uproar if that was a debate in the public eye? There would be riots. Ultimately I think that's why treaties are handled in secret; a public debate would cause so much fighting it would do more harm than good.

  22. Re:Shot in the back on Days After Shooting, Canada Proposes New Restrictions On and Offline · · Score: 0

    Durn. Intended to moderate funny; hit the wrong option, posting to undo.

  23. Re: Government Dictionary on Facebook To DEA: Stop Using Phony Profiles To Nab Criminals · · Score: 1

    Rarely do I see someone engage with the AC trolls and maintain their position calmly and rationally. Kudos to you sir.

  24. Re:Look to other jurisdictions on Text While Driving In Long Island and Have Your Phone Disabled · · Score: 1

    There are a lot of people who think drunk driving is equivalent to drive-texting, but that's illogical since people can set a phone down and ignore it, but they can't undrunk. I think the comparison is bad because it makes drunk driving seem less dangerous than it is and it makes it sound like you don't understand the difference between being in an diminished state and avoiding a distraction.

    That said, making it illegal to operate electronic devices while driving a motor vehicle is a pretty reasonable start. It doesn't matter *why* a person is driving unsafely, what matters is that they are. I find the specification of "electronic" a little silly since that makes any car with a battery (all of them in production) technically illegal, but I like the consistency. Do something that distracts your attention from an inherently dangerous activity (driving) and you break the law? Logical. Even if I don't personally like it. (I like lots of things that aren't logically supported by my long term goals; naps, beer, webcomics and cheetos spring to mind.)

    "Ban cheetos! They make people fat!" Fine, I'll switch to pringles and vote against you in the election. "Ban naps and beer!" I'll drink wine and sleep in and vote against you in the election. "Ban snacks!" you say? I'll attend your funeral and eulogize "Here lies Silvrmane, at least his argument was consistent."

  25. Re:Need harsher penalties. on Text While Driving In Long Island and Have Your Phone Disabled · · Score: 1

    Fair enough. I hope you do "buy a dash cam, record these knuckleheads and then post shame videos on youtube," but please don't just limit it to the people you know or suspect are driving badly due to texting. Driving unsafely is and should be against the law. We're in complete agreement on that.

    Please don't suggest that texting while driving is "just as dangerous as drunk driving" though, as that's an illogical comparison and it weakens your position. I can set a cheeseburger down, I can leave the radio alone, I can let the obnoxious gps navigator be wrong, I can ignore the fighting children in the backseat, I can ignore the ranting of my passenger and I can choose to give my full attention to the road. I can set a phone down. What I cannot do is undrunk myself because traffic demands it.

    If you're convinced that texting while driving should always be illegal everywhere and in every situation, then you have a perfectly logical argument. Don't diminish it by conflating it with driving intoxicated. It makes drunk driving seem less dangerous than it is and it makes it sound like you don't understand the difference between being in an diminished state and avoiding a distraction.