Slashdot Mirror


User: SuperBanana

SuperBanana's activity in the archive.

Stories
0
Comments
3,212
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 3,212

  1. it's not a matter of Linux vs. Windows... on Washington Post Says Use Linux To Avoid Bank Fraud · · Score: 2, Insightful
    ...it's more a matter of a read-only medium. If people start doing this is greater numbers, all the evil people will do is start distributing hacked ISOs pretending they're legitimate. This also doesn't do much for machines which have been hacked at a BIOS/bootloader level. In fact, if the PC is set to boot to the hard drive and the trojan supervisor is smart and puts up a boot menu that looks bios-ish (ie, allowing you to select the boot device), 95% of users would never notice. So unless Linux LiveCDs start running checks to see if they're being virtualized, this isn't a very good safety net.

    Also, honestly, how many people do you think check the MD5 sum on an ISO? Hell, I've never had a RedHat/Fedora disc that passed its self-check. I gave up on that ages ago.

  2. change control / management, anyone? on Entire .SE TLD Drops Off the Internet · · Score: 5, Insightful

    I seriously hope someone is fired or loses a contract over this. Where was the validation, change control, etc? I would expect that at the TLD level, a change to a configuration file would have to be inspected by someone AND run through some syntax-checking scripts...

    As for the person who was modded up for saying "hey, no big deal, fixed in 30 minutes!", not quite. DNS servers (and individual computers!) cache negative results. Anything anyone did a query on during those 30 minutes will be negatively cached by their system and their local DNS server. Granted, a whole lot of local Swedish ISPs and network providers have probably flushed their DNS server caches, but it's still going to seriously impact traffic to many, many sites, especially for everyone outside Sweden.

  3. so they put a solar panel on a Sony e-Reader? on LG Presents Solar Powered E-Book · · Score: 2, Interesting

    Uh...that's a Sony e-Reader, one of the early models. With a solar panel attached to the inside of the protective jacket (which seems like the wrong side...)

  4. clearly not a radiation engineer on Google Finds DRAM Errors More Common Than Believed · · Score: 5, Insightful

    That window looked out to a pile of coal, so the culprit was assumed to be low level alpha radiation.

    Alpha radiation is stopped by a sheet of office paper. It certainly wouldn't make it through the window, through the machine case, electromagnetic shield, circuit board, chip case, and into the silicon. Even beta radiation would be unlikely to make it that far.

    What is much more likely: thermal effects. IE, infrared from the sun heating up machines near the window.

  5. If 4chan made Star Wars, only beter on Fans Come Together To Complete Star Wars Uncut · · Score: 1

    Someone was definitely feeling their wheaties when they edited/timed the first face-paced segment. Some of the stuff is brilliant, though they should have allowed multiple submissions per segment; I saw some really, really bad stuff. As in, "hey, let's grab my point-and-shoot and spend 5 minutes on this." Somehow, the SVX seems strangely appropriate as a Millenium Falcon...ugly, cranky, and very weird. Nevermind it's absolutely hilarious when the driver shifts it into park to 'punch it'...

  6. it'll work and it's well equipped on Netgear WNR3500L Open Source Router Announced · · Score: 5, Insightful

    What can I do with this that I can't do with a dozen other dd-wrt routers?

    For starters, find it in a store. When my old 802.11g AP died, I had a hell of a time trying to do a JOIN between "StoreShelf" and "open source firmware compatibility list." I wanted to just go to the store, not order online. 95% of the stuff on the lists for DD-WRT, Tomato-whatever, and OpenWRT hasn't been sold in at least a year, or can only be found in one or two countries.

    Second, it's well equipped: you get N radios, a decent amount of RAM (64MB is top of the market, many devices have 8-16) and a full set of gigabit ports; I didn't notice whether or not they're handled by the CPU or an actual switch chip (the latter is better, if I remember correctly.) The list of 802.11n routers supported by the open source firmwares is pretty small. It becomes scarce when you limit yourself to gigabit ports and more than 16MB of ram. The only shame I see with this is that there's only 8MB of flash; that's stingy, but not the end of the world, as they include USB and DD-WRT and company are capable of using external storage for the OS. USB flashkeys, and 30MB/sec ones at that, are pretty damn cheap these days.

    Then: have it work, without spending an hour reading through scattered documentation, wikis, FAQs, and forum pages trying to figure out if you'll brick the device you just spent $50-100 on.

    Then: have it continue to work, without crappy performance, randomly rebooting itself, freezing, or slowly grinding to a halt over the course of a day or so. All of which I have had repeated problems with. On my N router, I could only get about 8MB/sec with DDWRT; on the stock firmware, I got 12.

    I love DD-WRT, it's amazingly, amazingly configurable- but finding supported N hardware that works reliably is a royal pita. I'm pleased to see that someone is going to release hardware that plays nice with the open source community and has a better chance of working properly. It's an extra bonus that it is pretty decently spec'd out.

  7. my examples assume the attacker knows the scheme on Sloppy Linux Admins Enable Slow Brute-Force Attacks · · Score: 4, Insightful

    The problem with 292 billion combinations or even just 17 million combinations is that your password will not be at the last point in the combination.

    My calculations on time involved the half-way mark, ie average time.

    However, you missed a more critical point: my examples assumed the the attacker knows exactly what combination you're using. Which he or she does not.

    Are your chosen words in English? Did you use punctuation? One number? Where is it? Did you substitute numbers for certain letters?

    They have NO IDEA. Scotch2!Foo. Simple, short, and completely bulletproof. I laugh at the idiots who sit there and pound away on complex root passwords. Sure, that can be done in production environments where you then set up an SSH host key so you can get in easily (and yes, root login is necessary sometimes- ever tried to scp an important system file? Pain in the fucking ass if you can't login as root.)

    Here's a simple test: run John overnight on your shadow file. If it can't guess your password, nobody's ever going to get in via ssh by guessing your root password. Ever. John tries passwords by the THOUSANDS per second...

  8. overly paranoid on Sloppy Linux Admins Enable Slow Brute-Force Attacks · · Score: 4, Insightful

    That system you have with SSH facing outwards - right now: PermitRootLogin no, PubkeyAuthentication yes, PasswordAuthentication no, Allowusers one-guy-only

    I'm sorry, but unless you have a laughably bad root password, this advice is unnecessary.

    Even at 1 connections a second, in an entire year, an attacker could only guess 525,960 combinations. 10 connections a second?(REALLY fast...) 5.2M/year.

    171,000 words in the English language, roughly. Pick two numbers, and now you're at 17 million combinations, and that's only assuming you put the numbers in one spot. Assuming they manage 10 connections a second, know the scheme you're using and hit it half-way (a HELL of a lot of assumptions in their favor) you're still looking at 1.6 years.

    Two english words and a number? 292 BILLION combinations.

  9. Re:It will never happen on California Requests Stimulus Funding For Bullet Train · · Score: 1

    The population density throughout the US is not really set up for a bullet train system because even if you did connect major cities, you would need cars and buses to get people to their spread out homes.

    Right, because we don't have those cars or busses...

    You do realize that the US is actually ideal for high-speed rail, right? It's not designed to get you from your house to your office. It's for crossing vast distances for people or freight; then people and freight take secondary transit.

    For example, coast to coast at 200mph is 15 hours, and we avoid the massive localized pollution (during takeoff) and upper-atmospheric pollution (when they're cruising.) You get on in California, get off in Boston, and via the subway, commuter rail, local rail, busses, and taxis. You can get anywhere in the state.

    The real trick will be finding the right balance between too many stops and too few. You want enough stops to make it versatile, but not so many as to kill average speed. Right now, Amtrak has that problem with the Northeast Corridor. You shouldn't have more than 1-2 stops per state, and local rail should fill in...

  10. the myth of Massachusetts on California Requests Stimulus Funding For Bullet Train · · Score: 5, Informative

    I think you may be mistaking California for Massachusetts.

    And I think you may have your head up your ass and have no idea what you're talking about.

    MA is 23rd as of 2008. Damn near dead average.

  11. after the CentOS debacle, pardon my disenthusiasm on Red Hat Files Amicus Brief In Bilski Patent Case · · Score: 1
    This is the company that used every means at its disposal to try and shut down, discourage, or stall the WhiteBox and CentOS projects. It was so absurd that the CentOS people had to refer to RedHat as "prominent north american vendor" in a press release explaining they'd been hassled.

    I understand that Red Hat was within their rights to protect their trademark, but they could have been much more pleasant about it.

  12. no, that would have been redundant on 2009 Ig Nobels Awarded, For Gas-Mask Bras and More · · Score: 1

    But did anyone else watching the sword swallower shout out to their computer display "Don't hiccup!"?

    No, because someone in the audience did before he started...

  13. I was there on 2009 Ig Nobels Awarded, For Gas-Mask Bras and More · · Score: 4, Informative

    bra that converts quickly to two gas masks,

    They neglected to mention the more impressive part: they did a live demonstration for six people, all using bras she was wearing, and she removed them without taking off any other clothing.

    She was also decently endowed, and I'm not referring to the size of her...grants.

  14. Put the onus on the client on Schneier On Un-Authentication · · Score: 2, Informative

    You make the client system re-authenticate after a configurable amount of time, and that authentication comes via central storage of authentication passwords/tokens. For example, Keychain.

    My laptop is set up with SSHKeychain, and it has options for locking my Keychain. If I activate the screensaver and don't come back within 3 minutes or so, it locks the keychain, and any program that wants to use a stored password triggers a password authenticaton dialog box for the system keychain password.

    This puts the power of security in the hands of the user or organization. Computer at home, no roommates? Probably not an issue to lock your keychain any time except when you shut down your computer. Work in a cube? After 5-10 minutes of inactivity or whenever you lock your screensaver.

  15. wire speed vs. practical maximums on First-Ever USB 3.0 Hard Drive · · Score: 4, Insightful

    Ignoring the naive assumption, USB 2 is as fast or faster than the majority of hard drives (which average reads in the 50-60MB/s range). Buying a faster connection technology won't somehow make your hard drive faster.

    I'm not going to ignore the blatantly wrong assertion that USB2 can transfer data at a 480Mbit/sec (60MB/sec), because it can't. That's wire speed. Latency (each packet must be acknowledged) and software handling of data kill speed dramatically.

    http://www.everythingusb.com/usb2/faq.htm#4

    As far as we know, effective rate reaches at 40MBps or 320Mbps for bulk transfer on a USB 2.0 hard drive with no one else is sharing the bus. Flash Drives seem to be catching up too with the some hitting 30MB/s milestone. For all we know, USB interface could become become the bottleneck for flash drives as early as 2008. Additional notes from Alex Esquenet - our engineer friend based in Belgium: "A fast usb host can achieve 40 MBytes/sec. The theorical 60 MB/sec cannot be achieved, because of the margin taken between the sof's (125 us), so if a packet cannot take place before the sof, the packet will be rescheduled after the next sof. On top of that, all the USB transactions are handled by software on the PC. For instance, a USB host on a PCI bus will send or receive the data via the PCI bus; the stack will prepare the next data in memory and receive interrupt from the host."

    Watch a linux host some time with 'top' as you transfer a bunch of data to/from a USB2 drive, and prepare to be shocked at how much time is sucked up by the USB driver.

    So yes, there is an immediate potential benefit given that many desktop drives can now push 100MB/sec at the end of the platter, and at the inside of the platter, still top USB speeds. Whether or not USB3 solves the clusterfuck of software drivers handling low-level protocol details etc is another matter entirely.

    In the meantime, buy a firewire 400 card, or even better, a fw800 card. You can get a 400-to-800 adapter cable for anything that isn't fw800, but it's pretty damn easy to find these days. Even if the data doesn't move much faster, you'll be using far less CPU.

  16. opposite problem, too on AIDS Vaccine Is Partially Successful · · Score: 1

    Finally, I think there's a problem with how the vaccine will be perceived. If the vaccine is only 30% effective, I think people will see that as being too risky to even get the shot.

    I'd be willing to bet you'd also get a lot of people who would get the vaccine, and thus engage in more risky behavior, figuring they've got a 1-in-3 shot "if I happen to have sex with someone who has HIV, and...." You'll also get people saying to their partners "hey, don't worry, I got the vaccine"...whether they did or not.

    It'll be even worse if the vaccine becomes 100% effective; say hello to skyrocketing rates of other STD's. At least a good chunk of the other ones are curable. HIV is the big nuclear scare for safe sex; without it, everyone's gonna get a bit less careful.

  17. 80 cores, 1TB of memory, and you got modded up? on SGI Rolls Out "Personal Supercomputers" · · Score: 4, Insightful

    I've seen the term 'personal supercomputer' so many times over the past 20 years. It's just baloney marketing. What you have on your desktop RIGHT NOW is more capable than some of the original CDC machines. So what?

    What you have on your desktop RIGHT NOW is most likely more powerful than the Cray Y-MP by a factor of three, if you've got a quad-core Core2 Duo; those babies push +1Gflop.

    It's also 1/50th to 1/100th as capable as this supercomputer (or more- I don't know the relative performance between a current desktop processor and current Xeon.) Yes, it's relative, and relatively speaking, this is most certainly a supercomputer. In terms of memory, the maximum amount of ram you can put into a consumer-available motherboard is around 64GB, maybe 128. This has a maximum of 10 times that.

    80 xeon cores, 1TB of memory, and you call it a "marketing ploy"? And you got modded up "insightful"? May the hand of metamoderation come on down from high.

  18. MPG != pollution on California Publishes Television Efficiency Standards For 2011 · · Score: 3, Insightful

    Last I checked, you could have the best running car on the road and still get 5 mpg.

    Last I checked, miles per gallon has nothing to do with pollution (and CARB stickers on aftermarket engine components don't get better mileage.) Witness cities in the 2nd and 3rd world where mopeds and motorcycles (which are not required to be inspected by CA) fill the air with choking smoke. You could be getting 40MPG and spewing NOx everywhere.

    If emissions are so important, why does CA except from emissions testing COMPLETELY: Vehicles made in 1975 or prior, Diesel-powered vehicles (which includes the ENTIRE TRUCKING INDUSTRY), Natural gas powered vehicles weighing more than 14,000 pounds, Hybrids, Motorcycles, trains, planes? Why aren't airplane emissions regulated? Did you know that a jumbo-jet taking off puts more pollution into the air in one takeoff than many cars will in their entire service life? Airports aren't transportation hubs: they're giant kerosene burners.

    I ride my bicycle every day in the city and emotards on their 1970's mopeds are spewing 1000 times more pollution than a car to look trendy and save money on gas, undoing all the work the rest of us are doing to cut our personal emissions. When I ride the subway, I see the commuter line roar by, its diesel engine belching a 3-foot-wide plume of blue diesel smoke..

    I drive a car that is actually negative-emissions because its radiator is coated with catalyst. And, it's a heavily modified for performance. It's not CARB legal, despite being negative-emissions, because the company that made my exhaust (which has a catalytic converter) didn't bother to spend the hundreds of thousands of dollars to get a CARB stamp. I take public transit to work, use the train to travel when possible instead of fly, and I bicycle 120 miles a week. So don't you fucking lecture me about emissions or saving the environment or the air we share.

    And, incidentally, I don't live in CA. I live in a state which proxies their emissions laws off CA, which means I don't have any legislative representation in the matters which affect me as a citizen of a different state.

  19. CA also has a history of unconstitutional laws... on California Publishes Television Efficiency Standards For 2011 · · Score: 5, Insightful

    ...for example, motor vehicle emissions laws which allow an officer to stop your vehicle on suspicion that you have non-CARB-certified equipment on your car or if your car is "modified for racing." Apparently CA whalehuggers aren't aware of those of us who like to drive our cars fast...at the racetrack or dragstrip. Or that many car enthusiasts have the best-running (and thus cleanest running) cars on the road, asshats who gut their catalytic converters excepted.

    If stopped, you're told to open your hood and allow the inspection. If you refuse, you're immediately arrested, your car is impounded and towed to the nearest CARB inspection facility. You better hope and pray that everything in your engine compartment is original or has a CARB stamp on it or your car (yes, the entire car) will be confiscated and you'll be facing thousands in fines. The CARB stamp is just a massive tax / attempt to discourage aftermarket parts, because it is irrelevant whether the modified car passes emissions standards, and CA charges a fortune to certify parts.

    Unreasonable search and seizure anyone? Oh, look, a baby seal. Welcome to the People's Republic of Kalifornia, the most legislated state in the nation, and sadly, that fucks over the rest of us, since product manufacturers don't want to be unable to sell in that market.

    Remember the clusterfuck that is MTBE, aka the chemical which reduces smog but pollutes the hell out of groundwater and is a known carcinogen? Guess who we have to thank for that?

  20. Re:We do not have the money on Lawmakers Voice Support For NASA Moon Program · · Score: 1

    Your knee jerk response is typical of whats gotten us into this mess. If America's budget is anywhere near as messed up as the UK's there are places that desperately need trimming and area's which should have increased funding. Ignoring the fact that massive sweeping cuts to public services will only cause the economy to fall back into recession.

    Huh? Aren't we saying the same thing? Your post was so full of wandering gibberish and bad grammar & punctuation that I couldn't tell.

  21. no, it's like having a $600 credit card balance on Lawmakers Voice Support For NASA Moon Program · · Score: 1

    This is like walking around with $600 in your pocket and giving a bum on the street $3.

    No, it's like having a $600 credit card balance at the end of the month after your paycheck has come in and you've paid all your bills, and saying "well, I'm $600 in debt from fighting my neighbor and giving gifts to all my roommates. What's another $3 on this scifi movie?"

    It's another $3 you don't have, that's what.

  22. We do not have the money on Lawmakers Voice Support For NASA Moon Program · · Score: 3, Interesting

    http://www.google.com/hostednews/ap/article/ALeqM5iWWPT8cAUpUCsmOZoABze-6XhwTAD9ALBNU00

    We're in the deepest recession since 1930, and have run up $1.38 Trillion in debt, people- and that's not all from the two wars we're fighting.

    The administration is forecasting a $9 Trillion budget deficit within ten years, a figure the Congressional Budget Office agrees with.

    "Only $3BN more" you say? That's a +15% increase of NASA's budget. "Oh, only 15%", you say. Well, guess what happens after 1000 federal agencies and projects have come to you asking for "only 15% more"? I can't even find a figure for the number of items in the federal budget, but I'm guessing it falls around 10,000 or more.

    Yes, military spending is an order of magnitude larger. That is not an excuse to increase spending for another agency; it is a reason to reduce military spending. That is something that is not easily done, given how dependent our country has become on military spending to employ people, and congresscritters are very allergic to "defense" cuts in their district.

    We need to be trimming from the federal budget, not adding to it any more, except for the most critical needs. Space exploration, while fascinating and a great boost for nationalism, is not a critical need.

  23. ASCAP would have to blink first on ASCAP Says Apple Should Pay For 30-sec. Song Samples · · Score: 1

    O RLY? Do you realize how many individual artists ASCAP represents?

    Do you realize how many individual artists would immediately see their royalty checks evaporate if they get dropped by iTunes? And that when those songs disappear from iTunes, people will start downloading songs and albums? Discover indie artists? Go back to seeing music locally in bars and concert halls?

    Apple has billions upon billions in the bank- plenty of cushioning to survive a momentary drop in revenue. Artists rely on that income stream to put bread on the table. I'd give ASCAP less than a week before they'd be back at the door begging iTunes to take them back, on account of the people camped out on their doorstep with pitchforks and torches.

  24. radio IS radiation...electromagnetic. on Garlic Farmer Wards Off High-Speed Internet · · Score: 1

    He should stick to farming and leave the radio vs radiation science up to the smart people.

    Which you're not one of, given that "radio" is electromagnetic radiation.

  25. redundancy, anyone? on Best Backup Server Option For University TV Station? · · Score: 1

    Recommending a backup solution where if one power supply dies you immediately corrupt the entire array? Yeah, that's JUST what he needs...