Slashdot Mirror


User: EndlessNameless

EndlessNameless's activity in the archive.

Stories
0
Comments
1,340
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 1,340

  1. Another Also-Ran or Illegal "Solution"... on EndGame CEO: Root Out Hackers Before They Strike (qz.com) · · Score: 1

    Anomaly detection and whitelisting are measures that already exist in actual code that can run on a real computer right now. Monitoring and alerting tools are becoming commonplace, and we even have an acronym or two to sum up the process (thinking of SIEM here). So this call-to-arms is either late or stupid, depending on how far it intends go.

    Assuming the attacker has half a brain, he will proxy his inputs and outputs through intermediate devices. Compromised servers, botnets, whatever. This pro-active approach will yield little usable information without tracking him down, finding his tools, or locating his caches of stolen data.

    In order to do any of that, your company must gain access to those proxy devices to see where he is coming from or to gather incriminating data if any exists. But wait---unauthorized access of a computer is against US law. The CFAA does not have any exemptions for IT vigilantism.

    So you must commit the same crime in order to catch the attacker. Unless he's incompetent enough to attack from his own home or office.

    At best, this is a call to use tools that any information security professional should already be aware of. It's nothing more than a glorified advertisement for their products. At worst, it is an encouragement to cross the line into vigilantism---which can have legal consequences.

  2. but if the logs show 100% acceleration, that just reflects the sensor value. Not that the user - or indeed anything else like a dropped handbag - actually pressed the pedal that far.

    There are actually two data points worth considering. First, the depression of the gas pedal to 100% was either a real event or a sensor failure---autopilot does not register pedal activation. But also worth consideration is the absence of brake activation.

    When parking, normally the brake will be depressed as the car rolls into the space. Even if the car accelerated without any input, you would expect panic braking in response. So even if the gas pedal erroneously registered 100% depression, you should see gas and brake depression simultaneously.

    A lack of simultaneous gas and brake activation would point toward a user error followed by a corrective response that was, unfortunately, too late to avoid a collision.

  3. Re:With Experience of Similar Incidents... on Tesla: Model X Accident Caused By Driver Error, Not Autopilot (computerworld.com) · · Score: 1

    Or you could look at the logs indicating 100% accelerator activation and 0% brake activation at the time of the collision.

    If the vehicle "drove on its own" without autopilot commands registering anywhere, then either two sensors failed (both the accelerator and brake were wrong) or else the driver accidentally depressed the wrong pedal.

    If I have to choose between a freak dual-sensor sensor failure and user error, I'm going with user error. I'll be right over 99% of the time.

  4. At the very least I expect someone to be able to operate a machine so that it is of no harm to me.

    Even experts make mistakes.

    As I suspect the 40-year-old female driver already knows how to operate standard automobiles, the accidental acceleration was a mistake rather than negligence.

    the person has no right to operate the machine

    There is a huge population of people who are competent in the operation of a machine yet are still mentally and physically capable of erring.

    I've never accelerated when I meant to brake, but I have activated the turn signal instead of the cruise control on several occasions.

  5. I frequently grab hot objects without burning my hand because I react to handling a 700 degree piece of metal by removing my hand from it.

    That's reflex, not conscious action. Most people do not have reflexes fast enough to avoid burns at that temperature; conscious movement takes significantly longer.

    Unfortunately, there is no equivalent reflex for leg muscles while driving so your analogy is irrelevant.

    See, when the acceleration kicks in, my brain goes, "Oh you must be on the accelerator!" The brainstem picks up on that as the midbrain feeds it sensory information

    Going up to the midbrain is much slower than reflexes, which are aleady barely be adequate for the task.

    Rolling into a parking space at 5-10 mph, you are moving about 10 ft/sec. Tactile reflexes are on the order of 150ms, so you've traveled at least 1.5 feet before you are physically capable of responding---and gained some speed as well.

    On top of that, you still have to "decide" to switch pedals, move your foot to depress the brake, and slow to a halt.

    Assuming your decision is essentially a reflex response (or a learned reflex) which does not require higher processing, you are still looking at 250ms before you could possibly start moving your foot. So we're looking at 2.5 feet of travel, plus whatever you might gain from acceleration.

    If we generously assume you could reposition your foot from the gas to the brake in another 250ms, you've traveled at least 5 feet unexpectedly with the vehicle angling into a space. In most parking scenarios, that alone will be enough to cause a collision.

    And that 5-feet of movement is an unrealistic best-case scenario---no need for conscious thought and practically superhuman movement from accelerator to brake. A real-world acceleration error would easily be 10-20 feet due to the delay for cognitive processing in someone who doesn't exhibit the reflex responses you claim to have. And again, this is not accounting for speed gained during that period of accidental acceleration.

    Even under best-case assumptions, a collision is fairly likely. A vehicle would be virtually guaranteed a collision even under favorable real-world conditions.

  6. Re:We need Loser pays on Man Sued For $30K Over $40 Printer He Sold On Craigslist (usatoday.com) · · Score: 1

    How is there any risk if you have a legitimate case?

    Off the top of my head:

    1. Your case requires expert testimony. A mechanic explaining an issue with a car, for example. Both sides have experts. The jury believes his expert over yours. Doesn't matter if your expert did a better job reviewing the data. Doesn't even matter if his expert was lying or just plain wrong, unless you can prove it.

    2. Cost. Some trials involve extensive discovery, numerous legal filings, forensic testing, or expert testimony. All of those things cost money. So do lawyers. If you run out of money and cannot pay for a test or an attorney, you may lose or be forced to drop the suit. Even if you're right.

    3. Both sides may feel legitimately wronged, and the way the law applies might not be perfectly clear beforehand. Part of your lawyer's job is arguing that a particular situation or action is covered by a particular law.

    4. The judge and jury are humans. So are the plaintiff and defendant. The events which led to the lawsuit may be clearly on one side of the law, but the judgments are based in part on how honest or well-intentioned the plaintiff and defendant seem to be. A perfectly kind and honest person could come across as a sleaze or a lunatic in the courtroom. A lot of scumballs seem polite and considerate until they sense an opportunity.

    On top of this, there is room for mistakes on all sides. Everyone, including you and your lawyer, can accidentally do something that hurts your case. And not all errors are grounds for appeal.

    So, how do you propose to eliminate all of these risks for people bringing legitimate cases?

  7. Re:We need Loser pays on Man Sued For $30K Over $40 Printer He Sold On Craigslist (usatoday.com) · · Score: 1

    That's lovely and all, but in America that case goes to civil court so our "loser pays" laws need to consider it.

    We have too much corporate influence on politics to have a strong consumer rights agency in the foreseeable future.

    That, and we have too many religious fundamentalists. If you get enough of them into a single government agency, the bureaucracy will become outright oppressive until some outside force corrects the situation.

  8. What happens in 50 years when all cars drive them themselves, are networked and so done want to cripple our infrastructure.

    That is simple enough. Require autonomous vehicles to be capable of navigating safely without network connectivity.

    Since manually-driven vehicles and autonomous vehicles will coexist for a while, the first networked autonomous vehicles will definitely support an "offline mode" that does not require peer interaction. Simply require that it be kept as a backup in case the network is down.

    On top of that, if vehicles can be setup or started in offline mode then it should be fairly simple to stop a worm, mitigate DoS, etc.

    We won't magically lose standalone autonomous driving capabilities just because networked vehicles are more efficient.

  9. Anyway, I would feel extremely uneasy about starting my car remotely, especially if I could not even see it. It amazes me that it is legally possible.

    I agree with the rest, but this I don't understand.

    A remotely started car will still be in park, and it will remain locked. Now, the owner could unlock it from his basements and leave it running for hours, of course, but that would be rather stupid.

  10. Re:Obama admits they already do it without a warra on Tech Firms Say FBI Wants Browsing History Without Warrant (engadget.com) · · Score: 1

    If they're routing any of the traffic, they can see US-based IP addresses going to those sites.

    Anyone routing any of your traffic can see that, actually, and IP has never been an anonymizing technology by itself.

    If the US government isn't routing anything itself, it can easily traceroute to ISIL servers and ask the last-hop provider(s) on US soil to log the source of all connections to those servers.

    This simple and legal method might not be how they're doing it---but the fact is that a simple and legal method exists by which the government can know that US citizens (and roughly how many) are accessing ISIL web sites.

    Now, unmasking those people and identifying them individually would (or should) take a bit more legal work. But the framework is there to start an investigation based on that initial, reasonable observation.

    I wonder if this is how they actually go about it because I wonder what monitoring capabilities they actually have. Still, this much can quite conceivably be done (a) legally and (b) without logging any other internet usage.

  11. Re:Stay Frosty San Fransisco on Nest's Time At Alphabet: A 'Virtually Unlimited Budget' With No Results (arstechnica.com) · · Score: 1

    Microsoft is not based in Silicon Valley.

    Technically, no, but in practical terms, they have a presence.

    Microsoft has a huge new technology center in Mountain View, and that's where they like to invite their enterprise clients. Only a small part of that complex is used for public conference rooms and demos.

    No idea what happens in the rest of the facility, but I imagine they are actively and heavily schmoozing the people and the businesses of Silicon Valley in addition to whatever actual work is being done there.

  12. Re:Man, this has to be a hoax on RSA Keys Can Be Harvested With Microphones (theregister.co.uk) · · Score: 1

    Someone obviously didn't read the article.

    The microphone listened while the system processed chosen ciphertext.

    It is necessary to interact with the server somehow while recording, as it must be decrypting specific data.

    This limits the scope of the attack significantly, but extremely resourceful organizations could probably manage it somehow.

  13. Re:Baloney on RSA Keys Can Be Harvested With Microphones (theregister.co.uk) · · Score: 1

    The initial research has to be done that way. Just like any other kind of research and development, you need to eliminate variables to determine what can work and what won't.

    Once you validate the concept, then you can start looking at implementing real-world, cost-controlled, mass-produced refinements.

    I suspect it will be far more difficult in a real-world scenario because the real world is always more complex than the lab, but the underlying vulnerability is definitely there.

    Fortunately or unfortunately, we will probably never hear of real-world cases. Anyone who develops this into a reliable surveillance tool is not going to publicize his success.

  14. Re:Play music at the same time on RSA Keys Can Be Harvested With Microphones (theregister.co.uk) · · Score: 1

    They were sampling around 1.7 MHz for RSA keys.

    Since human hearing tops out at 20-25 KHz, most speakers aren't built to emit sounds higher than maybe 30 KHz.

    There isn't exactly a huge market for speakers in the ultrasonic range. I'm sure there are some niche cases, but don't expect to find usable hardware or audio samples at the local Best Buy.

  15. Re:Tomorrow on slashdot... on Yahoo Becomes First Company To Disclose FBI National Security Letters (tumblr.com) · · Score: 1

    Yeah, that's the most generic and uninteresting paranoia I've seen lately. The FBI doesn't assassinate people for taking them to court.

    It is vastly more likely that she received some personal threats. With the company being broken up and sold off, there are probably a lot of disgruntled employees.

    Especially with her $160M golden parachute, plus a potential bonus from the sale.

  16. Re:First Ammendment on Yahoo Becomes First Company To Disclose FBI National Security Letters (tumblr.com) · · Score: 2

    The FBI has jurisdiction in several matters that might lead to NSLs. Terrorist acts are federal crimes, as are other things that might involve NSLs such as espionage.

    Anything touching classified information can land in their lap as well. In fact, most of it will, as local law enforcement generally will not have clearance.

  17. Re:How Is This a Surprise? on Elon Musk Suggests Tesla Model 3 Won't Get Free Supercharger Use (theverge.com) · · Score: 1

    I think this raises some concern about the viability of chargeable personal vehicles.

    I expect the parking garages in most cities will have "premium" spots that include charger access. Or maybe the garage markets itself as premium and simply puts them everywhere.

    The monthly cost of electricity compared to the rental price is negligible. As long as the maintenance on the chargers is reasonable, the operational cost won't be that high.

    not just to recoup the cost of the energy/infrastructure, but to accommodate "market forces".

    As electric vehicles become more common, the market for charger-accessible lots becomes larger and more profitable. At that point, the primary market force will be competition, and the effect on prices will be downward.

    Still, there will be at least a decade of charger-equipped spaces being premium. Most people don't replace their cars very often, and most new vehicles are still powered by combustion engines.

  18. How Is This a Surprise? on Elon Musk Suggests Tesla Model 3 Won't Get Free Supercharger Use (theverge.com) · · Score: 4, Insightful

    Lower margins on a mass-market vehicle means there isn't enough money to pay the electrical bill for the lifetime of the vehicle.

    Are people really getting worked up over basic and obvious economic decisions?

    I know two people who own Teslas, and both of them bought the in-home charger regardless of the availability of "free" charging. Topping up costs way less than a tank of gas, and they don't feel like wasting time at the station.

    The only reason Tesla could offer free charging in the first place is because the electricity costs so much less than gasoline. Their "free" fillup simply was not a large value to begin with---except for the convenience it offered on long trips.

  19. Re:Users Just Expect Computers to "Work" on Samsung: Don't install Windows 10 (theregister.co.uk) · · Score: 1

    Which is why we just had a 0-day for every version of windows from 2000 on up?

    That's a pointless argument. Every OS has zero-days, including Linux and BSD. Some exploits span multiple kernels/releases.

    Yes, we can. It's their OS, they should've told manufacturers to either provide the drivers or don't gain certification

    That makes no sense. They were never trying to certify the old machines for Windows 10.

    Is Microsoft really going to say: "Provide drivers for 5-10 year old hardware, or else we won't certify your new machines."

    No, because the OEMs would revolt. If it comes down to it, they do not need Microsoft certification to ship a product.

  20. Tentative Yes for Home Use on Ask Slashdot: Would You Recommend Updating To Windows 10? · · Score: 1

    I use my home desktop primarily for leisure.

    I have disabled or blocked the telemetry. This costs me a few features like Cortana and predictive text entry. If you like those features enough on your phone to send similar data to Apple or Google, it might be worth leaving it enabled on your PC. With a full keyboard and mouse, I don't see the point.

    Games are going to benefit tremendously by moving from Direct X 10/11 to Direct X 12, and Windows 10 is the only OS that will support it. I would like to see UWP applications take off since it's based on better security model than Win32, so hopefully that will happen but it's not guaranteed. Technically, the Windows Store is also available on 8/8.1, but I'm skeptical about how much longer those versions will see new features.

    If you're into those features, the upgrade is a no-brainer. If not, then it's not terribly important aside from end-of-life concerns for your current OS.

    My upgrades went smoothly on a home-built PC and a laptop. There is a pre-installation compatibility wizard, though, so pay attention to it. All of my apps and hardware scanned green, so I expected smooth sailing. I don't use resident antivirus software, however, and I might suggest removing it temporarily if you do decide to upgrade---this used to be a major cause of problems.

    On the enterprise side, the new security features make Windows 10 an absolute necessity if you have a functioning brain---but most of these "under the hood" changes offer little to home users. Still, Bitlocker and SecureBoot should be enabled if you are not dual-booting to another OS on that machine.

  21. Re:Someone ask Tom Cruise about this! on Billionaire Technologist Accuses NASA Asteroid Mission of Bad Statistics (sciencemag.org) · · Score: 1

    There is truth to that. Most people have no idea about the history of psychiatry, including this TV host.

    True, and psychiatry is an immature science.

    Additionally, there is no objective scientific test that can diagnose most DSM disorders

    Most diagnoses are mood or personality disorders, and there is no instrument that can measure patterns of thought or emotional responses very well.

    Gross emotional responses like rage are observable, but nuanced expressions are not. E.g., we cannot see specifically the pain and loneliness due to a lost spouse. Optimistically, this could be addressed by a decade or two of technological advance.

    psychiatrists rely on studying behaviour, asking questions, and forming conclusions based on that

    Ask a doctor how hard it is to diagnose physical ailments solely based on symptoms. Without measurable signs or lab tests, psychiatrists are fighting an uphill battle.

    Some disorders have Axis 1 components, so some patients have a clearly observable explanation for their condition. Most do not.

    psychiatry as a whole is highly unscientific

    I believe they are being as scientific as they can be, all things considered.

    I strongly dislike the fact that some practitioners are overconfident in their diagnoses and treatments.

  22. Re:Remember where the responsibility is on A Third Of Cash Is Held By 5 US Tech Companies (siliconbeat.com) · · Score: 1

    You're wrong.

    American CEOs have a responsibility to shareholder wealth enshrined in law, independent of any language in the corporate charter.

    In Dodge v Ford Motor Co., Henry Ford was forced to maintain a higher price on cars and a lower wage to workers. All because he expressed the charitable desire to spread the benefits of industrialization far and wide.

    If Tim Cook has Apple pay more taxes out of a sense of patriotism, he will most likely end up on the losing side of a shareholder lawsuit.

  23. Re:Only programmers on Student Exposes Bad Police Encryption, Gets Suspended Sentence (podcrto.si) · · Score: 1

    Not sure how your comment got so highly ranked. It seems to stem from ignorance.

    The laws dealing with assault and homicide have exemptions for certain situations. Self-defense is one of those, so harm committed in a reasonable act of self-defense is not punishable. The context and intent are important because the law takes them into consideration.

    I cannot speak to Slovenian law, but his intent would be irrelevant in the US. The primary hacking law here, the Computer Fraud and Abuse Act, does not take motivation into account. If a willful act violates the law, there is no motivation or intent which might legally justify it.

    Now, you could argue that the law should be amended and say what needs to be changed. But you didn't do that. You just sobbed about how this site makes you sad. Boo hoo.

  24. Re:Let Me Get This Straight... on Tesla's New Factory Project Imported Foreign Laborers (mercurynews.com) · · Score: 1

    I expect they have to maintain tight quality control over their parts suppliers because they are responsible if the product fails.

    There is a difference between contracting out for your products and contracting for the renovation and maintenance of your facilities.

    Everyone should be keeping a close eye on what happens with their products. The supplies and labor going into the product ultimately have an effect on the general public.

    But that level of oversight is not particularly important for other areas of the business. Perhaps some companies have a compelling reason to verify general contractors, but by and large this type of work has no impact on customers or the general public.

  25. Re:Confirmed on Microsoft Auto-Scheduling Windows 10 Updates (tomshardware.com) · · Score: 1

    Are you trolling?

    "I am locked out of that entire partition." Tell me, how would having backups make that partition accessible?

    A backup utility will have bootable recovery media. You boot from that and start your restore. They support both blank CDs and USB thumb drives, but this is 100% dependent on what tool you use..

    "My files are there, but I can't get to them." Again, how would having backups allow me to get to the files on that partition?

    You restore your files from the backups. How is this even a question? Once you have the original OS with a known user/pass, you have access.

    Put down the bong and think before you type.

    That's a mean comment for someone not doing much thinking himself. You cannot be "locked out" of a partition unless it is encrypted. Even without backups, you have a variety of options.

    You can simply put the drive in another machine and copy the files.

    Or you can put a spare drive in this machine and reinstall Windows there, then the existing partitions will be available as D:, E:, or whatever the next available letter is.

    Or you can use one of the many NT password reset discs to overwrite the local passwords.

    Or you can boot from a portable Linux distro or WinPE disc and copy the files over the network.

    Or you can take it to a local computer shop and pay them to recover the data if any of this is too complicated for you.

    But the bottom line: you are not "locked out" of your data, and this problem is quite simple to resolve.