Slashdot Mirror


User: cyberfunkr

cyberfunkr's activity in the archive.

Stories
0
Comments
168
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 168

  1. Re:Dangers of relying on the Tower of Abstraction on Somebody Tried to Hide a Backdoor in a Popular JavaScript npm Package (bleepingcomputer.com) · · Score: 1

    We all know that JavaScript is a pretty messy language to work with unless you're using some sort of framework. Part of that is that it's been pushed to do way more than it ever was designed to do and is hyper-complex as a result.

    I guess my question is how far up the abstraction tower goes. Why would developers pull hundreds of libraries from dozens of sources just to build a simple program? And more importantly, why would you dynamically pull these resources instead of building against a known-good set, and only update one of your dependencies when you've tested it completely?

    I know software is all about move-fast-and-break-things these days, but the "trust the Internet implicitly for all my source packages" is one thing I can't get my head around.

    THIS! A thousand times this.

    Seems like no one knows how to actually write code any more, they just know how to tape together a bunch of other peoples snippets.

  2. So I have a challenge for you all worried about this. Today, make a note of how much your internet costs. Then do some speed tests and record the results.

    In a year, do the same thing..

    Please make sure you're not just using a single source for testing speed. Also include speed of accessing "fake news" sites, alternative dating sites, non-christian information, Wikipedia, a BitTorrented file, and streaming a game.

    If the destinations you are trying to reach are black listed, just mark that column as "0".

  3. using nothing but the lowercase letter "a" on Password Power Rankings: a Look At the Practices of 40+ Popular Websites (helpnetsecurity.com) · · Score: 1

    The testing criteria is flawed.

    If websites did their security right, there is no issue with it just being "a".

    Once you salt, pepper, and hash that letter it becomes just as tricky to hack as "h&t3)__ner!1" -- 64 digits of random looking hex.

    A real indicator of a website's bad password storage is if there is a character limit. If they only allow password that are 12 characters or fewer, then you know they are saving the password in a recoverable format. You should also try doing a "Forgot Password"; if they can email your password back in plain text, I wouldn't trust that site with the recipe for a peanut butter and jelly sandwich.

  4. It's the law of nature on Developers Explain Why iOS Apps Are Getting Bulkier (ndtv.com) · · Score: 2

    As in nature, the more powerful grow bigger as to kill off the competition for food and space.

    By making my apps larger than required, it means there is less space for other apps on the phone. If room is at a premium, then you're less likely to load duplicate functionality (While it's nice to have two weather apps to get an average, if I don't have enough space, I'll just stick to the one).

    This can backfire as people may instead delete the one big app to make room for two smaller but possibly just as competent. However, since file sizes are not always quickly available, more likely people are too lazy to do the research.

  5. If they've automated such detection, they're already 'hacking' your site by violating your implied TOS.

    Thank you IANAL for attempting to give legal advice.

    There are no "implied TOS". If you do not make an effort to hide your site behind a click acceptance, it is fair game. What you are talking about is known as "browsewrap"; https://en.wikipedia.org/wiki/... - There is no hard and fast rules about browsewraps being enforceable. It's done on a case-by-case basis. So unless the legal text is on the same page (and not just "by reading this you agree to the TOS found on this other page") as the data you're trying to protect, and most likely would have to appear earlier on the page, not in a footer, you really don't have a leg to stand on.

    What sites are doing now is making obvious and unavoidable blockers (whole pages, modals, pop overs, etc) that will only go away with user interaction. These are referred to as "clickwrap". They are enforceable. The user (be it person or bot) had to perform an action acknowledging that they are aware and will abide by the policies.

    For legal reference, I would look at Zappos' legal failure:
    https://en.wikipedia.org/wiki/...
    https://www.forbes.com/sites/e...

    They tried to force customers into using arbitration in any legal matters. But there was nothing stopping a customer from making a purchase without ever seeing the TOS. Since the TOS was not obvious, and nothing could prove the customer saw it, it was not legally binding and Zappos' lost big.

    As a website owner, I talked with a lawyer in how to handle this. I added a checkbox to the end of the membership registration that must be checked before creating the account. I then save the language that was used ("I agree...") and a date/time stamp of the event along with their account details. So if anyone comes back and says they never agreed to the TOS and Privacy Policy, I have proof that they did.

  6. Re:MY PASSWORDS HAVE NOT BEEN HACKED on LastPass Bugs Allow Malicious Websites To Steal Passwords (bleepingcomputer.com) · · Score: 1

    I have three deadbolt on my main door

    Deadbolts are only as secure as the windows next to them....

  7. I interviewed for a QA position for a large corporation. Even though it was for a manual testing gig, they brought in a group of developers to be part of the "gauntlet" of interviewers. So on top of the normal "tell us about you" and "why here", one of them asked me a programming test question.

    After discussing what he wanted, I went to the whiteboard, struggled for a bit, then said, "I'm sorry, I can't figure this out at the moment. Can you show me your solution?"

    The smug developer explained (didn't actually write the code) how to tackle it. I paused and considered his answer and said, "That won't work because of X". The other devs in the room thought about it, giggled, and agreed. So they went back to asking relevant questions, and the one dev was silent for the rest of the interview. As we were shaking hands I had an epiphany and explained a working solution.

    I ended up getting the job and was assigned to QA a number projects lead by that developer.

  8. I commented the same way about *four and a half years ago*.
    https://slashdot.org/comments....

    AV spends too much time and resources on making things look pretty, yet scary, instead of actually doing an effective job.

  9. Some of us are against walled gardens that are "hardware locked." An example of this is buying into an ecosystem that only works on one vendor's mobile device selection. STEAM works on my PCs...

    Which this article points out is not a factor. You can play PlayStation Now in the walled garden of a PS3, a PS4, a PS Vita, *or your PC*. Guess it's not as hardware locked as you are trying to rally against.

    As for Steam's services being "essentially" free... PlayStation Now is $99 a year. That's less than $10 a month giving you access to 100's of games, making each one of them "essentially" free too

  10. Seems so familiar... on Pokemon Game Adds $7.5 Billion To Nintendo Market Value In Two Days (reuters.com) · · Score: 3, Interesting

    An extremely addictive AR/VR game... Makes people ignore their normal day to day... Some kind of mind control...
    https://en.wikipedia.org/wiki/...

  11. A short two-weeks notice on Ask Slashdot: Is It Ever OK To Quit Without Giving Notice? · · Score: 1

    While at my last job, I got an offer for something better in a new state. So I told the new company I'd need a month; two weeks for the current job then two more weeks to relocate. They agreed so I turned in my two-week notice. However it just so happened that I had to give the notice on the Friday just before the company shuts down for a week for Xmas/New Year's holiday.

  12. I think the first thing to note is that I doubt laws uses "quotes" to define a term like "plausible". So it is suspect that what was in the summary is not accurate/official/legal (surprise, surprise).

    Given that, I'll try and make an car analogy work.
    * Let's start with; yes, one person is the registered owner of the car so it is possible that that person is responsible for any infraction involving the car.
    * It is also possible that anyone else in the house could have taken the keys and borrowed the car without the owner knowing.
    * Perhaps a neighbor has a key to this car and the owner doesn't even know that they are using it
    * Maybe the car was left unlocked with the keys out in the open so anyone walking by could have used the car
    * What if this is one of those modern self-driving cars and a hacker has hacked their way in and drove it remotely
    * Someone slim-jimmed the lock and fooled On-Star to start it remotely
    * Someone just broke the window and hot-wired the car

    While option one is plausible, there are so many other ways that someone other than the person whose name is on the bill could the actual perpetrator, that you cannot summarily say "He's the one".

  13. Google Alerts on The Abandoned Google Project Memorial Page · · Score: 1, Interesting

    I don't know why Google Alerts isn't considered dead.

    I have not received an alert from then about anything in over two years. Which is very unfortunate as I relied on it for my company. I would have it alert me anytime it was mentioned so I could watch for trouble, positive and negative reviews, etc. My company is still around and making news, but the alerts just stopped showing up.

  14. They forgot the "The Last of Us" method on Mathematical Model of Zombie Epidemics Reveals Two Types of Living-Dead Strains · · Score: 1

    They list only two method of virus spread, but seem to leave out a third; zombification/infection by both blood AND by latent, airborne contact.

    **This will be kinda spoilery, but mostly open knowledge.**

    In this model, "zombies" are created not just by blood contact, but by an airborne pathogen. So the initial wave of zombies were created due to a spore/fungus. One that was based on a real fungus so I would think that would rank even higher than say, "Shuan of the Dead".

    So the ways to contract this "disease" are many:
    1) The typical bite, scratch, splatter, etc due to blood contact
    2) The fungus/spore that started the whole thing existing in the wild
    3) Those infected, once they reach a specific point, either by the host being used up by the fungus, or by some external death, create a landmine for an airborne version

    That third point is very important. Generally, once you "kill" a zombie, the threat is neutralized. Just kick 'em to the curb and burn when you get a chance. However in this model the corpse is still a carrier and must be handled and disposed of carefully to prevent new contamination. Once the fungus reaches a point where the host body no longer sustains it, it starts releasing spores which can infect any passer-by. So even though you stopped the horde today, tomorrow the battlefield can become one giant infectious cloud.

    Which means that while the population takes up arms to stop the physically attacking bodies, you need to dedicate a large percentage of the population for waste disposal. You're not going to be an effective fighter wearing a hazmat suit so the two groups should not mix. This depletes the number of people "fighting the disease" which may allow for greater rates of infection.

  15. Re:All or nothing approach is silly on 1.2% of Apps On Google Play Are Repackaged To Deliver Ads, Collect Info · · Score: 1

    The main problem of this is the developer now has the onus of describing to the user exactly WHY they really need that functionality within the app, and put in warnings and error screens if the user decides to turn off/disallow access. This adds a huge amount of bulk/overhead to even the simplest of apps.

    What happens if a photo editing software is denied access to your camera and/or saved photos? It appears broken so the developer gets negative reviews. This is an obvious example, but there could be more hidden rationals in other apps.

    - Your ToDo app wants to use the GPS so it can remind you when you are at a location to fulfill a task.
    - Your calendar needs your contact list to send out invitations.
    - Your game needs to access your camera to use VR or adjust the lighting.

    You end up with every app giving a series of popups asking for permissions that may or may not make sense. And if there is one thing we've learned, it's that when constantly bogged down with warning popups, people start ignoring them and just click "Yes" for everything making the whole security aspect moot.

    I'd rather see on the app store product page a listing of, "Here are the permissions this app requires, and here is the explanation for why it needs it." Then I can choose BEFORE I EVEN DOWNLOAD the app if I feel safe. Now, they could still be lying through their virtual teeth, but at least I have the foreknowledge to ponder why this app that is supposed to teach me about the stars needs my contact list and access to Facebook.

  16. Businesses need to learn how to kill employees on Withhold Passwords From Your Employer, Go To Jail? · · Score: 1

    Not actually kill them, but get in the mind set of a will; What would I do if Employee X died tonight?

    I have a will, so if I die, there are instructions so that life can continue without me; how money is to be handled, where important documents are stored, and the top-level password to the password manager program. The same needs to be always thought of in regards to employees. How would the business carry on if someone was no longer an employee tomorrow; both long term AND short term. (Death, disability, family emergency, quit, kidnapping, blow-to-the-head induced amnesia, etc)

    - What duties do they perform and who can we use as a backup?
    - What information do they have that we'd need to keep things running?
    - If a parasite crawled in their ear and they went rogue, who and how could we isolate them to prevent further damage?

    You get the idea.

  17. Re:Arguably lied? on Obama's Privacy Reform Panel Will Report To ... the NSA · · Score: 1

    In other words, change the line of questioning from binary to quantifiable.

    Not, "Is Linux open source?", but "What percentage of Linux do you consider open source?"

    Not, "Did you have sexual relations with that woman?", but "What parts of your body have been in physical contact with that woman?"

    Not, "Do you kick puppies?", but "Over the last two year, are you kicking more, less, or about the same amount of puppies?"

  18. As my old boss used to say.... on Stop Fixing All Security Vulnerabilities, Say B-Sides Security Presenters · · Score: 1

    "First you go through all the bugs we know--then you work on the bugs we don't know."

  19. Because the DMV doesn't know where you've been, or where you're heading.

    Park a plate-recorder van near the entrance/exit of the local gun show. One in the parking structure near a rally. A couple at select places of worship around town. You get the idea.

    Now cross reference that data with border checkpoints, HOV lanes, and other public traffic cameras.

    Instant, no-effort, and of course infallible watch-list.

  20. Re:Encrypted blob on Hacker Releases 1.7TB Treasure Trove of Gaming Info · · Score: 1

    Remember, this is encrypted, not compressed.

    I run a small-sized website. Not including graphics, I have almost 40MB of data.
    Heavily commented source
    Archives of old, or out-dated source
    Upgrade scripts
    Notes
    API information
    DOC files
    UI examples
    etc...

    It doesn't take that long to build up data now a days.

  21. Re:Where's the story? on PayPal Denies Teen Reward For Finding Bug · · Score: 1

    Dammit! You're spoiling all the wild conjecture, conspiracy theories, and bandwagon-jumpers fun by adding facts and basic reading comprehension skills.

    What's next? Emailing Reddit users links to Strunk and White's Elements of Style?

  22. Zardoz is happening on One-Time Pad From Caltech Offers Uncrackable Cryptography · · Score: 1

    http://www.imdb.com/title/tt0070948/synopsis?ref_=tt_stry_pl

    Infinite data being stored in a single crystal; all depending on how the light refracts.

  23. Re:Seems reasonable on Lenovo To Drop Iomega Brand On Joint EMC Products · · Score: 1

    I don't know why they ever bought into the name in the first place. I never had any of the drives that exhibited the dreaded "click of death", but once I was foolish enough to buy a CD-RW drive made by someone else but in an Iomega box. It had problems from day 1. I later learned that the manufacturer had firmware updates for their version that fixed the problems, but even years later there were never firmware fixes offered for the Iomega version of the drive. First and last thing with the Iomega name on it that I'll ever buy.

    Um... so... wait, I got lost somewhere in there. Are you saying you didn't ever use a Zip Drive and are talking out of your ass in the first bolded part, or that you're using overconfident and demonstrably false terms to try to impress us with your disdain for Iomega, meaning you're still talking out of your ass in the second bolded part?

    I say the whole thing is BS. Let's break this down...

    I never had any of the drives that exhibited the dreaded "click of death" - implies that he's owned more than one zip/jaz drive.
    but once I was foolish enough to buy a CD-RW drive made by someone else but in an Iomega box - so he got a Mitsubishi or other OEM drive that happened to have an Iomega face plate? In that case he should be bitching about the OEM manufacturer. Or does he really mean just the "box", as in, it's a TEAC drive, but the cardboard box said Iomega and you said, "Seems legit"? In which case, you should really be bitching about TEAC.
    I later learned that the manufacturer had firmware updates for their version - So there was a fix for the hardware
    but even years later there were never firmware fixes offered for the Iomega version - But since the "box" said Iomega, he waited until Iomega said go. Unknown if he tried the drivers of "someone else".
    First and last thing with the Iomega name on it that I'll ever buy. - Because the box it comes in is all that matters.

    Nope... doesn't add up.

    Personally, I've owned and used the parallel version of zip and it worked great on both Mac and PC. Installed a few IDE versions of the zip and they worked like a charm too. Recently had to fire up a system with the internal zip, and out of 10 disks I tried reading, only one failed to be read. And it's possible that that disk was a left over Mac format.

    I miss the old zip disks but they didn't scale, weren't as portable, and cost more than the up-and-coming USB flash disks.

  24. Re:slow news day? on No Such Thing As a Tax-Free Lunch At Google? · · Score: 1

    So anything that benefits me is 'income' and therefore taxable? What kind of strawman thinking is that?

    I get Vitamin D benefit from the sun - not income
    I get oxygen benefit from the trees - not income
    I get psychological benefit from people smiling at me - not income
    I get the benefit of time and enhanced productivity when people hold open the door for me - not income
    I get nutritional benefit when I buy lunch - not only not income, but an expense!
    I listen to a CD a friend let me borrow to help me relax - not only not income, but a possible fine of up to $22,000 and jail time!

    Just because you get something out of it, doesn't make it an income.

  25. Re:Better answer on Microsoft Creative Director 'Doesn't Get' Always-On DRM Concerns · · Score: 5, Insightful

    "Hi, this is the Microsoft Vacuum Inspection Division. I see you're trying to turn on your vacuum. Let me just double check to make sure everything is in order."

    "Oh? That's cool. So you're looking for defects, making sure that my device is going to give me a great experience?"

    "Ah... yeah... no. That's not what we do."

    "Oh. Well then you're going to double check the settings to make sure that I'm not using the wood floor setting on my shag rug, right?"

    "Not so much."

    "Are you at least going to make sure that the filter is installed correctly and warn me that it needs replacing?"

    "No, but we will make sure that you're using official Microsoft Filters. Use of any other brand will void your warranty and cause the vacuum to overheat and burn a red ring into your carpet."

    "I see. Well, speaking of carpet, I had to change out the wheels because the default wheels keep getting snagged on my rug. But I figure, I'm only vacuuming my own rug so it's no big deal."

    "Oh? Is that so? Guess we're done here."

    "Thanks for stopping by! Time to get back to... Hey... How come my vacuum doesn't work any more? I can turn it on, but nothing is getting clean."

    "Since you modified the vacuum, that would give an unfair advantage to your abilities, so we had to stop you from using your vacuum."

    "Unfair advantage? I'm cleaning my house. My own house! What does that give me an advantage over?"

    "I'm sorry but we need to make sure that all customers of the SuckBox 720 have the same experience. Allowing you to use yours would cause problems if you ever vacuumed with your friends."

    "Vacuumed with..? You really think I'm going to bring this to a friends house and have a race of who can do suck dirt better?"

    "Sorry, but your vacuum is equipped with an Always-On Dirt Regulator Mechanism to prevent tampering so Microsoft can monitor vacuums to make sure no one is cheating or trying to give a bad experience to other owners."

    "How do I cheat at vacuuming? And it's just MY OWN F'N CARPET! Who cares how I do it? Fine. I'll put the old wheels back."

    "Sorry. But your vacuum has been marked as banned and will never work on our system again. If you wish to purchase a new vacuum, we will allow you get back on-line. However, we also flagged your registration information, and the credit card used to buy the vacuum. You'll have to register under a different name and use a different credit card or your new vacuum will be deactivated also."

    "Hello, big name electronics store? I'd like to order a DysonStation 4..."