Slashdot Mirror


User: TheRaven64

TheRaven64's activity in the archive.

Stories
0
Comments
32,964
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 32,964

  1. How much is a second-hand phone worth relative to the value of the data on it? A modern phone that's used for work may have a load of confidential emails and credentials for work systems. The phone itself is trivial to replace, the access that it may grant to your corporate systems is difficult to mitigate if it's not reported stolen immediately and data stored on the phone itself may contain a lot of confidential information. The entire threat model for these devices is built around the idea that it's far worse for an attacker to get access to the contents of the phone than for them to get the device and not the data.

  2. Re:Someone's been watching Black Mirror... on Chinese Journalist Banned From Flying, Buying Property Due To 'Social Credit Score' (cbslocal.com) · · Score: 4, Insightful

    ie. All the stuff that would rate you as an "asshole".

    All the stuff that would rate you as an 'asshole' today. Unfortunately, once such a system is in place it becomes very easy to use it to disenfranchise people who disagree with either the current leaders or the whoever is currently best at propaganda. How do you think the racial equality movement in the US in the '60s would have done if anyone involved in antisocial actions had lost the right to vote?

  3. Re:"Their" inital impressions? on Slashdot Asks: How Do You Like the New Gmail UI? (vortex.com) · · Score: 2

    That depends a lot on the style manual that you read. My publisher (Pearson - owns InformIT and the several imprints including Prentice Hall, Addison-Wesley) recommends alternating male and female pronouns for gender neutral terminology, but permits using the plural. I find the alternating horribly confusing (if you're talking about a single person and switching from he to she every use then it seems like you're talking about two people). I believe that the last two revisions of the Chicago Manual of Style also now endorse use of they and their as gender-neutral pronouns (though earlier editions were strongly against it). I think the Oxford style guide now also recommends 'they' as a gender-neutral pronoun, though that was a more recent change.

  4. If they force you to use SMS for 2FA, then they have a plausible reason for asking for your telephone number. The Google Play Services and all of the Google apps on iOS have access to the phone number of the device, so they can tie your mobile and desktop accounts, for building a better advertising profile.

  5. Re:Interesting timing on Surface Phone Speculation Spurred By New Phone APIs In Windows (arstechnica.com) · · Score: 1

    Do you have a citation for Windows Phone getting higher return rates than other phones? And, if you do, how many of those people returned them because they didn't like Windows Phone and how many because there weren't any third-party apps?

  6. Re:Boo hoo. on Electric Buses Are Hurting the Oil Industry (bloomberg.com) · · Score: 1

    Heat rises, moron.

    No it doesn't. Hot fluid rises above colder fluid and we call this convection. The GP was talking about radiation, which is omnidirectional unless directed by a reflective material. If you're going to call other people a moron, it's generally a good idea to be right.

  7. Re:Boo hoo. on Electric Buses Are Hurting the Oil Industry (bloomberg.com) · · Score: 2

    LED lights so far don't seem particularly better than CFLs. They certainly don't seem to be lasting longer.

    Have they been around long enough to tell? I've rarely had a CFL fail after less than a decade of use. Most LEDs I've seen are rated to last 40 years, but have only been cheap enough to be a sensible choice for about 1-2 years.

  8. Re: Not surprising on A Study Finds Half of Jobs Are Vulnerable To Automation (economist.com) · · Score: 2

    Right. I'd challenge any average office worker of today to go run a farm...not to make money, just to feed themselves. I'd wager they'd starve in a year.

    Both you and the grandparent are making the same mistake: conflating education and intelligence. Most people are sufficiently intelligent to run a small self-sufficient farm. That's pretty much what 95% of the population was doing a few hundred years ago. The difference is that, back then, they were taught the basics of farming from when they were old enough to walk. Now they are taught to read and write instead. Most of those peasant farmers would have been able to do simple office jobs with the same training.

    The real problem is the amount of time that the training takes. If you need skills that take 10 years to acquire to move to a new job, then that's not a good short-term solution for you. And it's also not a good long-term solution if that job isn't going to be around in 10 years and you don't know what skills will be required for the ones that will be.

  9. Re:Interesting timing on Surface Phone Speculation Spurred By New Phone APIs In Windows (arstechnica.com) · · Score: 1

    I know a few people who liked Windows phones, but it is undeniable that they were widely hated

    But were they widely hated by people who actually used them? I have only met a few people that used Windows phones, but each one has liked it and been sad to give it up. I've met a lot of people who hate Windows Phone, but none of them has used a Windows phone for more than 2 minutes in a shop and most of them never even held one in their hands. Mobile phone shops were hiding Windows phones and steering customers away from them.

  10. In a previous thread, someone suggested generating and storing one-time pads on phones. It would be quite interesting to use bluetooth when you're physically near one of your contacts to automatically exchange a few tens of MBs of random noise and then use that as a OTP for future messages sent to them. For large attachments (e.g. photos), you could send a 256-bit AES key and then use symmetric encryption for the contents, but still have the OTP for text messages. 10MBs of OTP key would be more text messages than most people send in a year (around 75K, assuming that they are all full length).

    It would be an interesting experiment...

  11. Re:Interesting timing on Surface Phone Speculation Spurred By New Phone APIs In Windows (arstechnica.com) · · Score: 2

    I disagree. My partner had a Nokia Windows Phone and reluctantly gave it up for an Android phone a few months back when it became so old that the TLS stack wouldn't connect to modern servers. She liked both the hardware and the software and still finds Android clunky in comparison. She'd still be using it today if Microsoft had managed to persuade third-party developers to invest in the platform. The one thing that she does like about Android is that when she sees a company telling her that they have an app, they actually do for her phone now.

    If you could run Android apps on a Windows phone, I'd probably have got one as well - it's the only mobile UI I've used that hasn't annoyed me (I have an Android phone and an iPad).

  12. Re: They lose my business on What Happens When Restaurants Go Cashless (usatoday.com) · · Score: 1

    There are no terms, BECAUSE YOU DID NOT ENTER IN TO A DAMN CONTRACT. Them simply having a sign which you may or may not have seen is NOT a contract, and never will be. For it to be a contract they must verify that you have seen and agreed to it.

    In any common-law jurisdiction, the legal definition of a valid contract simply evidence of 'a meeting of minds'. There is a large body of case law regarding signs, particularly in the case of parking on private property. If there is a sign saying 'parking $5/hour' and you park, then you are assumed by law to have agreed to pay $5 for each hour that you park. From the perspective of a court, a contract has been agreed and if you don't pay then you are legally in breach of contract.

    They cannot just make up extra parts to this fantasy contract to penalise you further for it.

    They don't have to. A contract exists and there is statute law regarding breach of contract if the debt is not settled according to the terms of the contract. The common case would be to simply refer you to a debt collection agency, who will crap on your credit record and charge you the fee and take you to court if you don't pay. Unless you can convince a court that a reasonable person (in legal terminology) would not have seen the sign, then you will lose. If you try to argue that the contract is illegal then the other side's barrister will ask you if you saw the sign and were aware of the terms and entered with the intent to disregard them and then sit down content in the knowledge that you've just agreed to pay his legal fees.

    It would not be legal anyway, because the law says so. In the same way that they cannot put a sign saying 'no gays allowed in our restaurant!'

    The law does not say no. If it did, barter and commodities trading would be illegal. It's perfectly acceptable for me to offer to sell you 5 tons of flax in exchange for 12 tons of wheat. If I deliver you 5 tons of flax and you then say 'oh, actually, I don't have any wheat' then the law says that I am required to accept cash for the settlement of the debt, but it also allows me to take you to court for breach of contract, or allow you to settle out of court for a fee. A contract requiring payment by credit card is exactly the same kind of transaction. If you aren't able to pay in the form defined by the contract, then you are in breach of contract and can either pay a fee to settle out of court, or you can go to court and pay a lot more.

    Putting a sign up saying 'no gays' is only not permitted because of explicit anti-discrimination legislation and has no relevance to a simple breach of contract with legally permitted terms. Putting up a sign saying 'no jeans, no trainers' is completely allowed, for example.

  13. Re:Facebook/Google or...MS? on Who Has More of Your Personal Data Than Facebook? Try Google (wsj.com) · · Score: 1

    How are you supposed to verify US law enforcement has no access to something?

    Microsoft has been audited by the German government for compliance with their regulations preventing sharing of sensitive data with the US. The data centres in question are operated by a legally separate company. If a US court wants access to them, then they must attempt to claim jurisdiction over a German company, which holds German government data. Good luck with that.

    If Intel SGX really is the magical solution to anything getting hacked by anyone, why isn't it the hottest topic at every security conference in the world?

    I take it you haven't been to any of the top security conferences for the last couple of years? There have been a lot of SGX-related papers.

    how do you defend the contents of the disk or the contents of RAM from leaking to an attacker while still supporting virtual machine booting and live migration?

    Data on disk is encrypted with a key known only to the user. Data in RAM is encrypted with a key known only to the CPU. When the secure enclave has booted, you get a hash that you can provide to a third party (Intel) to attest that the enclave state is as you expect. At that point, you can provide the enclave with the key that allows it to access other data. The interfaces between the enclave and the outside world all have compiler Spectre mitigation techniques applied.

    Live migration is not supported for SGX enclaves, they must be restarted on a separate machine. The current SGX implementation is limited to 32MB of state for enclaves, so does not support a full VM, the intended model for the prototype is to put just the sensitive part of the computation in there and leave anything that deals with encrypted data shuffling outside. SQL server uses this to allow you to store certain columns in encrypted form but still run queries on them that the DBA can't see the results of (they're run in an enclave that can decrypt the data, perform the query, and encrypt the result for transmission to the user who is authorised to see the result).

    And, of course, Intel backdoors are surely game-over

    Yes, if the processor is not trustworthy then this can be bypassed, though not necessarily in an undetectable way.

  14. We know that NeXT valued that code, that code was critical to NeXT's development system; code for which there was no alternative then.

    That is categorically not true. NeXT licensed the StepStone Objective-C compiler (as I recall, they actually bought it outright and then licensed it back), which was a source-to-source translator from Objective-C to C. They could have used this without modifying GCC at all, though at the cost of worse debug info.

    NeXT's decision to "throw code over the wall" (as you passive aggressively say) came after talking to the FSF. NeXT did not do this on their own.

    I don't know why you think 'throw code over the wall' is passive-aggressive phrasing. That's exactly what they did. They continued to maintain their own GCC fork, providing code dumps but nothing to make it easy to integrate the code upstream. It wasn't until many years later that Apple pushed their code into a branch in GCC's svn and the FSF relaxed their requirement on copyright assignment to allow some of it to be merged back into the main trunk.

    It doesn't matter if you conclude that the FSF would have been better off in some alternate version of events because that didn't happen.

    On the contrary, it did happen with Clang. Apple released clang under a permissive license, which allowed them to incorporate parts of the front end into their proprietary IDE. On non-Apple systems, Clang provides vastly better support for Objective-C than GCC ever did. The end result is that, if you care about Objective-C on Free Software systems (as I do), you are better off avoiding GCC. Hardly a resounding win for the GPL.

  15. It's not possible to hide if the server admin runs tools like 'rkhunter'.

    I've not heard of rkhunter before, but from how it works I can think of a few ways to hide. It doesn't appear to scan the contents of kernel memory, so if you're able to inject running code into the kernel and masquerade as a low-priority kernel thread then it won't be noticed. It also isn't able to scan into SGX enclaves, or into any of the (now compromised) trusted firmware on AMD systems, the latter of which gives you a good way of persisting your malware across reboots.

    If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.

    On the plus side, it would be rebuilt by the beginning of next week.

  16. Re:Threat on Who Has More of Your Personal Data Than Facebook? Try Google (wsj.com) · · Score: 3, Insightful
    Nonsense. Governments have historically been among the largest abusers of power for two reasons:
    1. They have been the largest concentrations of power.
    2. They have been the least accountable.

    Do you honestly think that if you concentrate power in an unaccountable organisation it is less likely to abuse this power because said organisation doesn't call itself a government?

    Take a look at the history of the British East India Company if you want to see what happens when companies have more power than governments. At least modern governments have structures that are intended to allow those over whom they have power to replace them periodically.

  17. Re:Facebook/Google or...MS? on Who Has More of Your Personal Data Than Facebook? Try Google (wsj.com) · · Score: 5, Insightful

    I think it's also to do with the fact that, even when Facebook wasn't selling data, they were taking so little care of it that third parties were able to exfiltrate it without any problems. Even if you trust Facebook and the companies that Facebook shares data with, do you trust all of the companies that are able to access Facebook data without permission because Facebook is so bad at security?

  18. Re:Facebook/Google or...MS? on Who Has More of Your Personal Data Than Facebook? Try Google (wsj.com) · · Score: 2

    By European standards, MS is a criminal enterprise at this time because of this.

    Why? Microsoft collects debugging information via Telemetry. They claim, and I have yet to see evidence to the contrary, that they use this solely for debugging problems with Windows and Windows software and do not share it with other parts of the organisation for use in profiling or targeted advertising. All of this is explicitly permitted by the GDPR.

    In addition, if you host anything in Azure, you have the option of using a data centre that is owned by Deutsche Telecom and which Microsoft US has no access to, so you are also shielded from US law enforcement. They have also invested a lot in their Secure Cloud initiative, the prototype of which is available to select partners and uses Intel SGX to allow you to run code in Azure that Microsoft has no visibility into, even if they are running a malicious or compromised hypervisor.

  19. Re:Seriously? on Who Has More of Your Personal Data Than Facebook? Try Google (wsj.com) · · Score: 1

    Do they? If you don't turn it off, Google knows the location of your phone (which, for most people, is their location) to GPS accuracy, all day. They also correlate this with phones owned by your contacts, so they know who you met with face to face. The mobile provider knows which cells you are in. With some effort, they can triangulate your position from multiple cell tower pings, but they don't (yet) do this routinely. They also can't always do it easily, because a number of cell towers are still operated by smaller companies that just lease them to the big players, who don't get full signal strength information. They can't easily correlate this with your contact information (they don't have it), your purchasing or browsing information (they may know the domains you visit, but with TLS they don't know the individual pages that you visit) and so on.

  20. Re: I find all of his "predictions" outrageous on Kurzweil Predicts Universal Basic Incomes Worldwide Within 20 Years (hackernoon.com) · · Score: 1

    Most of what we think of as human thought is the capacity for abstract reasoning. The process of learning to think for a human is largely the process of learning to emulate a computational device that is not a neural network. Being able to build complex neural networks doesn't actually help in this direction.

  21. Re:His overly optimistic predictions... on Kurzweil Predicts Universal Basic Incomes Worldwide Within 20 Years (hackernoon.com) · · Score: 2

    Moore's Law is not about increasing performance. It's about increased transistors in a given area for a given cost. Which continues to increase.

    It's still increasing somewhat, but it hasn't been following Moore's law for a while. The newer process technologies have not been coming in at lower costs. The older ones are getting cheaper, but only because the fab and R&D investments have been paid off.

    It's just getting just smaller, cheaper chips, not faster ones. That makes datacenters have more processing power but not your desktop.

    Ironically, the stagnation in Moore's law is one of the drivers of innovation in datacentre compute. It's worth Google's time building TPUs, for example, because chips built on an older process technology and optimised for a specific use are not going to be surpassed by cheaper general-purpose chips any time soon.

    The end of Moore's Law is compounded by the end of Dennard Scaling a decade ago. This means that, even when Moore's Law is giving you more transistors, you can't power them. The number of transistors on a chip that you can power at any given time has not increased much since around 2007. This means that it is worth investing die area in something that is 10x faster for a given use, but is only used (and therefore powered) 2% of the time.

    Both of these mean that it's a fun time to be doing hardware research, because you're not going to find that by the time you've brought something to market Intel is coming out with a new chip twice as fast (or half the price) that can simulate whatever you're doing in software.

  22. Re: His overly optimistic predictions... on Kurzweil Predicts Universal Basic Incomes Worldwide Within 20 Years (hackernoon.com) · · Score: 1

    You may think AI is a dream, but what you have missed is that AI has already passed many of the major milestones on its path to surpassing humans.

    Really? I did indeed miss that. Modern AI is as far away from actual thought as it was in the '60s. It's a lot faster at providing correlations, but that's mostly down to advances in hardware. The techniques currently being used by the big buzzwordy deployments are strictly less expressive expressive than a Turing Machine, so it seems like we're heading away from AGI, not towards it.

  23. Re: His overly optimistic predictions... on Kurzweil Predicts Universal Basic Incomes Worldwide Within 20 Years (hackernoon.com) · · Score: 1

    The last fully costed UBI proposal I saw showed that, factoring in the UBI payments that I'd receive, my net income would be down around 2-4%. It's probably optimistic, but if it's 6% I'd still consider it worthwhile.

  24. The science is settled. Global temperatures are rising. Sea levels are rising. Severe weather is getting worse.

    The science is far from settled. A significant net increase in energy is arriving in the atmosphere. The climate is a chaotic system and we've pushed it away from an equilibrium point. There are still a load of open questions including whether it will reach a new equilibrium that is amenable to human habitation at all, whether we will see a shift in which areas in the world are amenable to human life, and whether there's anything that we can do to adjust this outcome (and in what ways).

  25. Re:Failing electronic system on What Happens When Restaurants Go Cashless (usatoday.com) · · Score: 1

    I've seen enough stories where the restaurant has a fault with their credit card system, and thus has an extremely long delay in processing them

    And you've seen these stories because they were news: i.e. they were unusual things. How many times have you actually seen it happen? My local shop had this happen a few weeks ago, but it was just after they upgraded their POS system (to one that really is a POS system, in all senses of the term) and it was the first time in a decade I'd seen a technical problem prevent a shop from accepting cards. The same problem also meant that they couldn't easily accept cash, because failure was in their POS system and not the bank network.