Slashdot Mirror


User: DarkOx

DarkOx's activity in the archive.

Stories
0
Comments
6,020
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 6,020

  1. Re:So? on It's Way Too Easy To Hack the Hospital (bloomberg.com) · · Score: 1

    Its not hard to imagine an ISIS or similar group creating a worm the 'punish the infidels' or warn us against continued melding in the middle east against their interest.

    Actually I am really surprised given the fact so much of or infrastructure is a soft target a group like that has not invested in doing so. They would have to pay off one sympethizer to plant a device on hospital network to phone home. Then via reverse tunnel they find some vulns in common hospital equipment. Now they write a worm using some of the vulns in the comfort of their own shit hole. Release said worm thru the same reverse tunnel initially.

    They wait until some deaths and injuries make the news, then they release a video and threaten to do it again if we don't withdraw or whatever.

    Hell they might not even have to identify a western conspirator it might be possible to just strait hack hospital netwrok from the out side and get all the way into a device network.

  2. Re:Separate the security from the device on It's Way Too Easy To Hack the Hospital (bloomberg.com) · · Score: 1

    The problem with that approach is you raise the likelihood that you security fix has a negative interaction with the device. At that point you are treating it as blackbox. Yes you can figure out what ports it need a throw a firewall in front of it but, that won't protect you from some form of command injection.

    So now you firewall has to be protocol aware. Cool is a standard protocol like HTTP or is proprietary and do you have the docs in the latter case. Lets assume its regular HTTP, can we block certain VERBs? Who knows I'd really hate to find out that the little used abort "dosing command" was implemented with PUT. Same goes with another filtering or you might apply. Lets try and prevent SQLi by looking for things like SELECT, DELETE, UNION etc oops the device uses that for something...

    Proprietary protocols are going to be even harder: Buffer overflows etc, are you completely sure about the maximum number of characters that field should ever allow? What if you accidentally truncate a command?

    What if the device actually did take at least the basic security step of using SSL, can your intercept device handle outbound flows now?

    Its one thing to stuff a bunch of PCs and office workers behind a next gen firewall and try to filter stuff. If you break Office Updates, or GotoMeeting nobody is likely to be killed. I would not want to play that game with medical devices though, and a simple port filter isn't going to be enough to solve the problem. No unfortunately as infeasible at may seem to try and ensure every networked medical device is secure, it would be even crazy to try and solve the problem by segmenting them.

  3. Firefox is unuseable on Mozilla Plans To Remove Support For Firefox Complete Themes · · Score: 1

    Time to go back to the tried and true sensible interface that is SeaMonkey.

  4. Yes actually they should be treating them because they are not combatants in the fight between the USA and Taliban.

    Except that isn't the case, because many of the fighters are non uniform we know who is a combatant and who isn't much of the time. Someone can be a noncom citizen on Tuesday and fighter by Friday over there only to hang up their guns again by Sunday afternoon. The 'rules of war' only work when you are fighting another state that also respects them. They make all kinds of sense, they keep your own people safer and better treated when captured. The thing is you don't send captured forces back home after they continue so they can fight you again, you continue to detain them until the end of the conflict.

    What DOB is doing in the middle east is operating revolving door facilities. Frankly I don't think we should allow it. For all the good they are doing for true non-coms there they are also treating and releasing people who will be shooting back at 'our boys' we are still sending over there to fight for ... ugh something. Unless and until we are prepared to detain anyone of fighting age after treatment, I don't think it should be allowed. Detention isn't practical right now because the situation is to fluid and we don't control the territory.

    The other options is DOB, at least the American members, start getting discriminating about who they treat. Since you can't identify a Taliban or ISIS member easily, that might mean you only treat women, children, and the elderly, men aged 14-60 or so are are out of luck.

    Otherwise what DOB is doing is giving aide and comfort to the enemy.

  5. Re:Portable health care on App Companies Propose New Model For Worker Benefits (cio.com) · · Score: 1

    My suggestion to dismantle the group market does not crush private insurance either. It just shifts who the client and payers are. If you kept the individual mandate (something I DO NOT SUPPORT) the size of the pool would remain about the same the nature of the participants would remain about the same. The difference is people's insurance would be as decoupled from their employer as their cable bill is and that would be a good thing! It would mean that changing jobs does not mean changing insurance providers, which in turn does not mean changing hospital networks or primary care providers, as is frequently required if you change insurance plans. Ask anyone with an ongoing condition if they want to change doctors. If the ACA was about allowing people to get the care they need in a cost effective way it would not have been done this way period. ALL of the major arguments for it offered the public were LIES. Its about time someone stand up during the state of the Union and shouts down the president again.

    Lets face the ACA's structure was designed not to avoid crushing private insurance but as a give away to private insurers. There were plenty of ways to make insurance more affordable without doing single payer, fixing rather than exacerbating the insane employer benefit tax structure would been a good start. More cynically I think its the typical leftist elites hatred of lower class, who they pretend to champion. It should have been painful obvious that group was going to be disproportionately sent to the exchanges and that group subsides or not would be least likely to be able to afford care, and would end up paying additional taxes. It was well known states would refuse the medicare expansion, even that has a bomb in it where the Federal contribution goes away after a time. So its essentially an unfunded state mandate. The entire ACA is really a poor tax!

  6. Re:Just Moral Panic: They're taking our jobs!!! on New Book Sold Out Offers a Look At the H-1B Debate · · Score: 2

    There just aren't any qualified people available.

    But what is that? -- is what the question we should be asking is. The US and Canada have university systems that are the envy of most of the world. The US is far and away the worlds biggest hightech center.

    Certainly we have the resources here to educate, train, and develop qualified people. How come that isn't happening? Is possibly because people don't want to sink tens of thousand of debt financed dollars into something the might not succeed at like Computer Science and instead choose to major in business where they can be assured of graduation on time and being somewhat employable?

    Is it because companies no longer want to develop talent and as you say refuse to higher anyone that does not already have a job and exactly the right specialist education? Do they do that precisely because they have the option of importing that talent from some where else rather than having to invest in developing it? I think so.

    Does that steady stream of cheap labor depress wages, absolutely you need IT you can't compete in business without it today. You absolutely need engineering and math people to develop new products. You would PAY whatever the going rate is or make the investment to develop the internal talent to get it if that were the only way. Which would make the risk proposition of someone investing in all that education required more palatable. Sure it might take them longer to finish school but the life time earnings would be higher!

    Right now the H1B system is creating a huge disconnect. If it was used to bring in a handful of PHD level people with very specific expertise, doing mostly blue sky research this would be a non issue. That isn't how its used though.

  7. Re:Not all H1B positions are equal on New Book Sold Out Offers a Look At the H-1B Debate · · Score: 4, Informative

    In many areas of the USA, you can have a nice 2000 sq ft house with large yard and a 30 minute drive to work for both spouses and good schools for your kids. In the SF Bay Area, even if you have a million dollars (or more) to spend on a house, there are very few options places where you can have that.

    In other words you WERE NOT offering a competitive wage nationally. You right the H1B program does not require you to go on some national talent search but to simply advertise the position. The point of the law though was to address national worker shortage, that is how it always is/was talked about and sold to the public. So the H1B program is broken! The law does not work as expected and is instead having unintended consequences.

    Salaries in any field consider the local cost of living. H1B was not developed to make sure your company have bodies in seats in a particular corner of California. There are always economic efficiencies in certain areas specializing. If you want the efficiency of having all the nations tops tech talent living in silicon valley you have to pay for that or you should have to pay for that! Yes that means paying them enough that they will personal enjoy a better quality of life than they can have for what someone is willing to pay them in Kentucky. That might be a dump truck full of extra dollars.

  8. Re:Portable health care on App Companies Propose New Model For Worker Benefits (cio.com) · · Score: 2

    Affordable Care Act did not solve the problem at all in some ways it made it worse.

    Under the ACA a job loss for most folks means the same insurance loss or COBRA situations as before. We get our insurance as an employee benefit, which our employers offer because they will be punatively taxed otherwise. So in addition to a job loss and the need to find a new job you also need to find a new insurance carrier, that you might only use for months or weeks while you are out of work, or pay some hugely expensive COBRA bill.

    At the same time the ACA more or less eliminated minimal coverage and high deductible plans that people could have switched into in that situation. You don't need a plan that covers all that preventative care for example while you are unemployed and expecting that situation to be temporary. You do probably need/want to save money. The Affordable care act has ensured only expensive choices are available. Affordable my ass.

    What the ACA should have done is destroy the group market rather than the individual market. Everyone could have just purchased individual insurance but not everyone is a member of a group. The sensible thing to have done would have been start taxing employer benefits as regular income, and DISCOURAGING employers from offering them. Then individual mandate or not (I would say not because I care about freedom) you could have simply made health/dental/vision insurance costs tax deductible on the individual income tax side.

    The ACA was the most abject stupid design possible!

  9. Re:No concept of family or shared homes. on Viewing Data Harvested From Smart TVs Used To Push Ads To Other Screens? (securityledger.com) · · Score: 1

    They have the technology, to solve that. They correlate the TV viewing with any other device that appears behind the same IP address. They have other research that tells them what demographics each show appeals to. Knowing you're an older adult with two grown children living with you is information they want to have as well.

    So they know the 21 year old probably isn't watching NCIS religiously, that has to be you. They track your other devices individually behind that NAT. They use cookies, your user agent, JS to identify browser quirks and even machine performance to uniquely identify the devices and probably their users, time of day when the requests are made and more. There is a good change the advertiser knows the Kindle Fire Tablet is mostly used by you and the Asus Tansformer belongs to your 23 year old. They show the ads accordingly.

  10. Re:No concept of family or shared homes. on Viewing Data Harvested From Smart TVs Used To Push Ads To Other Screens? (securityledger.com) · · Score: 1

    The biggest hurdle really is the in ability to install ssl ca certs on these devices.

    SQUID with ssl_bump and using Privoxy as a forward works wonders. You can use iptables to redirect everything on 80/443 and 53 (tcp and udp) to your local router. I have found its very important to force the use of my own DNS as well.

    SQUID can be a transparent proxy and Privoxy does the filtering. The setup works really well but if you want to do SSL intercept you have to be able to install your own CA certificate on devices behind the proxy. You effective offload certificate and revocation checking to SQUID. This setup is nice because other than installing the cert there is no setup and you don't have to trust software to respect your proxy and DNS settings, the router WILL ensure everything gets proxied!

    Privoxy gives you a nice interface for capturing the URLs and writing rules to block or change content.

    Unfortunately the inability to modify the certificate trust store on these devices means you will either break SSL or if you don't intercept SSL from these devices they are back to being able to do whatever they like leaving you with no ability to filter.

  11. Re:Microunits Sound Normal on Dorms For Grownups: a Solution For Lonely Millennials? · · Score: 1

    I figured your typical door room was something like 10x14 so about 140 sqft. My assumption is you need to at least double that to account for a tiny kitchen area and bathroom. So to me 300ft sounds about exactly like a dorm room plus what is described.

  12. Re:Microunits Sound Normal on Dorms For Grownups: a Solution For Lonely Millennials? · · Score: 2

    300 feet is pretty small. A normal size single bedroom apartment is more like 700. Well everywhere I have lived and either had or known someone who had a single anyway. Disclosure I have never lived in NYC or Tokyo. Usually a two bedroom will be around 900 ft.

    So 300ft is pretty tight. It sounds like we really are talking about something the size of your college dorm room + a little kitchen space + tv area. I guess it would be alright for someone who just graduated or is moving out of their parents place for the first time. I remember furnishing my first apartment and my first house for that matter was an expensive problem. You end up either buying really shitty stuff that you will toss out just a few years later or doing horrible things like trying to use a TV tray as a writing desk because you can't afford a decent desk and don't want blow $200 on one of those press board hunks of crap.

    That said, if a younger person asked me, I don't think I'd advise them to do this. One of the things about moving out on your own is you get to for the fist time set your own schedule, do your own stuff without having to be so consider of others. Its a change to find out what you like! Plunging into another semi communal living situation, won't give you that opportunity.

  13. Re:Implications on US Judge Rules Against NSA In Phone Spying Case (reuters.com) · · Score: 2

    There is there is no Jusrisprudence because it is a district court ruling. Those are basically the lowest level federal courts, that hear most cases. Until there is at least an appellate court ruling their decisions don't usually create case law that impacts other courts.

    What is interesting is there is no stay granted. Which does mean the NSA must comply with the judgement right away or they may be found to be in contempt. One wonders if the NSA has the technical capability to do so without shutting down large portions of their surveillance. Usually in cases where there is likely to be an appeal and there implementation of the ruling will be large or complex a stay is issued until the appeal can be heard.

    IANAL but I think one could be held in contempt for not complying with a judges order even if an appeal is later successful because the issue is the non compliance not the order.

    To me the interesting issues here are:
    1) How will the NSA demonstrate to the court that it has complied?
    2) If the NSA refuses and the judge finds them in contempt what can / he will he do to a three letter agency

  14. Re:How can there be? on No Such Thing As 'Unlimited' Data (wired.com) · · Score: 1

    4k video ~4Gigs per hour
    Linux distribution dvd ~4.7 gigs ea

    Even with you hypothetical you are only up to about 270 gigs. You still have 30 gigs of head room there! I suspect that is a pretty damn big month for most Americans. Three new AAA video games, probably at $60+ is what is eating most of the bandwidth in this hypothetical. If you have money for that you can afford the overage charge if you do manage. If you don't download one or two those giant games you got a lot more room to watch TV which i suspect compares favorable to the median house hold use case.

    Most people are not streaming 4k and I suspect most people are really not going to be. Unless you are spring for a pretty big screen 60"+ 1080p really is good enough for anyone. Smaller screens than that (if actually used as TVs) at 4k seems like just wanking to me its not like you can tell at 6ft back. There isn't and won't be alot of 4k content at there in the near future either, given its in excess of the broadcast standard.

    In the end maybe 300GB isn't the right cap, maybe its 400 but its not a TB

  15. Re:This is why we don't trust them with anything on US Spends $1bn Over a Decade Trying To Digitize Immigration Forms, Just 1 Is Online (washingtonpost.com) · · Score: 1

    I don't think there should be limits on contributions private property and the disposition there of it, is the very corner stone of liberty. Once you start telling people how they can spend their own money, freedom is just a joke. I also generally support peoples right to be anonymous, because I think that can enable a freer expression of ideas. If someone independently and anonymously wants to run issues ads, I think that is okay and their should be no limits on their downing so.

    I do think though as we have a representative democracy, the public has a right to know just who is being represented by whom, to that end I think we should require all campaign contributions to individuals or recognized political parties be public information. We also need to end the Super PAC nonsense. That is tricky one though. Its a bit like holding the Beeb responsible for the actions of his unofficial fan club. You can't or should not prevent people from running a private supporters group but yet you have to keep it that way. Right now most of the candidates control their Super PAC even if there is thru nods and winks.

  16. Re:How can there be? on No Such Thing As 'Unlimited' Data (wired.com) · · Score: 2, Insightful

    Yes but words have meanings. "All you can eat" means just that how much food can you proccess through you gut while you are willing to sit there and do that. I am not aware of an "Unlimited food!" restaurants.

  17. Re:How can there be? on No Such Thing As 'Unlimited' Data (wired.com) · · Score: 1

    I generally agree with you but I also feel it never should have been sold as unlimited. Words do and should have specific meanings. Unlimited implies there are no limits or at least not limits out side of natural physical constraints. They should have sold it as "overage free" or something like that.

  18. Re:How can there be? on No Such Thing As 'Unlimited' Data (wired.com) · · Score: 3, Interesting

    their shitty business model and deceptive marketing are their own damned problems

    Yes they are which is why they are moving away from that model.

    Unlimited for a flat fee is a stupid model. Economically it makes no sense at. It encourages waste. We have an internet full of people who are busy running p2p clients constantly replicating crap they have no intention of ever looking at. Its dumb its waste.

    There may come a time when we have fiber on every door step and time on the network becomes 'to cheap to meter' but we are not there now. A 300GB/m cap allows you to watch plenty of Netflix. One would hope there would be a higher service tier for affordablly available for folks that actually need that sort of thing. The current system though where the majority use 10s GBs a mother subsidize building a network extra big to support a handful of people who want to transfer terrabytes from residential locations isn't exactly fair or reasonable.

    Then there is the well they should upgrade the infrastructure more so... crowed. Really explain that! We get a lot crying on slashdot about how $AsianCountry has faster broad band. Nobody can seem to say what they actual economic advantage of that is. What can do at 1Gbps that I can't at say 16Mbps? Currently Comcast is offering 75MBps (down at least) a lot of places that is enough for multiple full HD streams. What economic advantage is there to having more? (well I can download an OS image in few moments, yes and with a smidgeon for fore thought I can start it before I leave for lunch and have it when I get back too as it is. How much investment should we make in making that tiny improvement?)

    The internet is not changing as fast as it once was. We moved from online video and streaming anything being almost unthinkable in 1992 to every geocities page embeding real media by 1996. How much has changed between 2012 and today as far as what we can do with the Internet? Not bloody much! The tech is maturing. The information super highway is built out. It should be more about maintenance now than build out. The need for expansion just to be ready to handle what is coming down the pike isn't there anymore. My guess is real time immersive VR will be the next big line of demarcation. spoken word -> written word -> printing -> movable type printing -> photography -> radio -> television -> BBS and similar -> pre-web Internet services -> WWW -> multimedia enabled WWW -> VR.

    Most of America probably has enough bandwidth do VR 1.0 whatever that is now. Stop you bitching invest in the technology when it makes sense to do so. Being the first has its disadvantages. Its why we are stuck with all this old copper run around everywhere today. Most of us have more than we can gainfully use already, better to play wait and see and buy into the right tech after the needs change rather than before.

  19. Pick any Digital signage software you like on Ask Slashdot: Tiny PCs To Drive Dozens of NOC Monitors? · · Score: 1

    What you really need is a digital signage solution to manage the displays. There are lots. Almost all of them are capable of embedding a web page on whatever they describe as a 'layout'. This will give you the advantage of being able to display any other kind of content as well. Now all you need is the smallest stack-able x86 machines you can find, to put in the closet nearest to your displays.

  20. Re:I suppose on Persian Gulf Temperatures May Be At the Edge of Human Tolerance In 30 Years (arstechnica.com) · · Score: 4, Interesting

    I don't what planets WWII you have been reading about but I have news for you. While we certainly did fight a total war targeting civilian sites with industrial applications like factories etc we most certainly did not target hospitals and civilian food stocks (with some notable exceptions). We did hit many of these things because bombing with WWII technology had about a 24% accuracy. The British actually counted success has hitting the correct city, at least for night raids. Hitting them and targeting them are not however the same thing.

    When occupying territories we did usually install our own safety force and disarm local government employees. We did however in many case leave local governments and civil machinery intact for administrative purposes. We certainly did not inflict maximum death anywhere after the surrender or withdraw of military forces in the area. Oh and we hung around and rebuilt the place when we were done.

    The problem in the middle east is that there isn't any working civil machinery and what of there is antithetical to our deeply held beliefs about justice and freedom among other things. I don't agree with your read of WWII at all. I would suggest occupied Germany isn't a good analog for anything having to do with post invasion strategy in the middle east. Where I can agree with you is about the need to occupy the territory, if you are going to invade. I would still argue that we should simply not accept refugees and invest all the money we would otherwise spend invading and occupying into simply securing our boarders and making damn sure we know everything there is to know about anyone we are permitting to enter instead but that is another discussion.

    What is needed in the middle east if you are going to invade is a British colonial style system. We need to bring in our own civil infrastructure and system of law. That needs to be setup as superlative to any existing civil infrastructure, but we should leave whatever does exist intact as long as its complicit and willing to operate as our client. We need to spend 20 or 30 years ensuring that people who get with our program enjoy comfort and success and people who don't are pushed to the margins. That is how you change a culture, slowly and by making it apparent clinging to the old ways means being a nobody.

  21. You can't blame the isolationist argument / strategy for failing when the so called refugee crisis is at its root a failure to follow that strategy. There is no good reason, for Syria's border states to permit the entry of refugees, let alone for Europe or USA to do so. I suspect keeping those people there would actually clean up the mess in that country more quickly as it would leave a group of people of quality (those that want a better life) there with incentive to fix things.

    Secure the boarders let the situation sort it self out.

  22. Re:Controlling commercial pollution on VW Engineers Have Admitted Manipulating CO2 Emissions Data (reuters.com) · · Score: 1

    I hope I'm alive to see the end of burning in order to create energy and power.

    Well I have good news for you, your dream is reality!

      See: law of conservation of energy

    Not only do we no long create energy by burning we never have!

  23. Re:Fine Example. on Hackers Who Hit CIA Director Break Into Law Enforcement Tools (wired.com) · · Score: 1

    This is what the national security people don't understand or can't admit.

    Information like most things flows for a high concentration to a low concentration. The more you collect centralize and organize the more effort required to keep it where you want it, the greater the potential consequences when you fail. (See OPM hack).

    Mass surveillance and information sharing makes us less safe.

  24. Re:Too much hype for what it actually is on Vulnerability In Java Commons Library Leads To Hundreds of Insecure Applications (foxglovesecurity.com) · · Score: 3, Interesting

    2) Accept said user input and sanitize it.

    Good luck with that! its like accepting user input that you are going to insert into a javascript string to write back to the client in a web application. No matter what you have done to sanitize it there is still almost always a hole. You just can't safely inject user controlled content into an interpreter or execution context, less the syntax is really well defined and limited. Consider SQL injection, SQL syntax and grammar is pretty specific yet it too 10 years before functions like 'escapestrings' became dependable in major frameworks and everyone had rightly moved on to tools like parametrized queries or solutions like linq by then.

    Thinking you can take a object as an external input from anything but a trusted source is asking for trouble. If you do trust the source than the input domain is probably limited to begin with and there is almost certainly a better way.

  25. Re:Remember Trump and Sanders on Full Text of Trans-Pacific Partnership Released (Officially, This Time) (mfat.govt.nz) · · Score: 1

    That is exactly my point as to why we can use a fed taxes the states, states tax citizens or counties, that in turn tax citizens model.

    The American public won't stand by while their fellow citizens suffer and starve. Which is what would largely happen in places like WV if we adopted that model and made any pretense of requiring each state to shoulder their fair share.