Slashdot Mirror


User: WuphonsReach

WuphonsReach's activity in the archive.

Stories
0
Comments
3,320
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 3,320

  1. Re:Unstable on Ubuntu Unity: The Great Divider · · Score: 1

    On an 11.04 Ubuntu install with an old S3 SuperSavage chipset... the GUI would regularly crash out if I tried to run in anything other then 1400x1050 on the laptop. (This laptop is from 2003 or so.)

    So, not just ATI, it's any video card that is not well supported by the drivers has a good chance of crashing the entire GUI.

    (It wouldn't crash the entire machine, which was good. But it would immediately boot me back to the login screen every time I attempt to run some of the video card tests using the testing tool.)

  2. Re:Truecrypt on 'Motherlode' of Data Seized At Bin Laden Compound · · Score: 1

    Except that very few people actually use a 128-bit passphrase (either to generate the symmetrical key or to protect the private RSA key). So saying that 128bit or 256bit keys are super secure is misleading. Yes the old 56 bit DES is trivial to crack, it only has 2^56 possibles (and the birthday paradox cuts a bit off of that). So if we assume that you can check 40 trillion keys per second (which is optimistic):

    2^55 = 36,028,797,018,963,968
    / 40,000,000,000,000
    = 900 seconds
    (1800 seconds if you discard the birthday paradox)

    The problem is that a lot of people will just use a dictionary word, which puts it at around 1:10,000 possible keys if you use common words or 1:300,000 if you use an uncommon word. Or they'll chain together two or three words. Which is (300,000 ^ 3) or:

    27000000000000000
    / 40,000,000,000,000
    = 675 sec

    If you're lucky, they use a completely random 8 character password, we'll assume each digit can be 1 of 80 possibles. That works out as:

    80^8 = 1677721600000000
    / 40,000,000,000,000
    = 42 sec

    Ooops. Not so secure if you only use 8 characters or less in your password / passphrase. In fact, it's so weak that you can probably build a machine for under $5k that can crack any 8 character password within a month or so. Or build a larger array, since passwords can easily be checked in a parallel fashion.

    The odds do get better if you use at least a 12-character, completely random password.

    80^12 = 68719476736000000000000
    / 40,000,000,000,000
    = 1717986918 sec

    Then you at least has something large enough to be difficult. Even for a determined attacker who can use all 100 top supercomputers along with a few hundred thousand desktops with NVIDIA CUDA.

    All of this, however, assumes that there is no rate-limiting in place. Most SSH or login systems don't allow constant retries of an account's password at much above 1 try per second (or even 1 per 10 seconds). That has a drastic effect on how long it takes an attacker to guess the password (and 8-character passwords, as long as they are random are okay). Account lockout will usually happen before the attacker guesses the password.

    But if an attacker has the *hashed* version of the password, knows how the hash is calculated, and lots of time on their hands, then anything of 8 characters or less is extremely vulnerable and you have to go up to 10-12 characters now to protect things. An example of this would be someone managing to swipe your /etc/shadow file, or grabbing a hash off the network in a situation where the hashed password is sent to the server (instead of a challenge/response system). Or a physical intrusion where they manage to grab the password hashes.

    (Yes I realized that 40 trillion passwords per second is over the top. But for $1M, you can probably build something right now that checks close to a billion hashes per second.)

  3. Re:take off your android/apple colored glasses on RIM Announces BlackBerry 7 OS · · Score: 1

    Storm2 was a huge step up from the Storm. (I'm a satisfied Storm2 user for the past 18 months.)

  4. Re:Ok but I would on Hotel Tracks Towels With RFID Chips · · Score: 1

    Like a giant safe. Locking rollup doors on all four sides, and a locking flip-top lid. She goes into a room and pulls this thing flush to the door frame. It may even lock to the doorframe (that's next if it's not already).

    I could see that having more to do with stopping theft from open rooms while the maid is busy in the bathroom.

    Protecting the towel supply might just be a fringe benefit.

  5. Re:Crappy phones on RIM Collapse Beginning? · · Score: 1

    I remember the bad press about the Storm, but compared to the Moto Q I had, the Storm2 has been very reliable and useful.

    The on-screen keyboard took some getting used to, but the Storm2 "click" when you press the screen makes a huge difference.

  6. Re:GPT Support on Ubuntu 11.04, Slackware 13.37 · · Score: 1

    Keeping it simple means making use of LVM and leaving a bit of extra space on the drive rather then reserving it all during the initial install.

    One of the file systems needs more space? Unmount the file system, resize the logical volume, resize the file system (a separate tool like resize2fs), then remount the file system and you magically have more space without having to do a huge backup/restore.

  7. Re:GPT Support on Ubuntu 11.04, Slackware 13.37 · · Score: 1

    I don't know anything about GPT, but every linux distro I've used will happily install to a single partition. IMHO there's no very strong reason to have separate swap and boot partitions and so on.

    One of the key strengths of Linux/Unix is that you can put any part of the tree onto a partition with a file system that makes sense for that part of the directory tree. Or where you need the system to not barf completely if one file system encounters severe errors or runs out of space. Even better, the process is nearly seamless to any applications running on the machine, making it easy to separate user data from operating system files.

    By putting /boot in a separate partition, you can dismount it or make it read-only during normal operations. So a process that corrupts some part of the file system will not also corrupt /boot (because it is dismounted or read-only).

    You can choose to use a different system for something like a media folder where you need better support for large files (ext3 tends to choke when deleting large files).

    You can move portions of /var/log to their own file system, so if the log files get blown out, the machine still runs.

    Putting /home on a separate partition makes it easier to upgrade the operating system (or even replace it entirely) without impacting user data.

    Now, if none of that matters to your use case, then feel free to put everything on a single partition. But you're really limiting yourself.

  8. Re:Why not? on German Company To Install Linux On 10,000 PCs · · Score: 1

    Now I admit I've never used it myself, but LibreOffice base is a 'database program' which should be comparable to access.

    OOBase or LibreOffice Base is still a joke compared to MSAccess.

    The biggest issue I ran into when I looked at 3.0 or 3.1 was: Can't pull information in from other Base databases at the same time that you want to query something in ODBC or another data format. Then there was the issue that you couldn't even import/export CSV without going through the Calc program (copy the table to a calc sheet, then save that as CSV). That was in version 3... it was a bit of a face-palm moment.

    There are some key niches where MSAccess trumps the competition. Mostly dealing with small unique data sets where the overhead of setting up a SQL server is overkill. Need to make a quick copy of the data? Ctrl-Ins/Shift-Ins and you have a copy of the table/query/form/whatever. Want to reorder columns? Some database tools won't let you do that. It's just very good at handling data sets that are "one-offs" and non-standard.

    I've written up more detailed complaints about Base in the past year. We looked at it - and it can't do what we need it to. And we don't even run any home-grown MS-Access applications. We just need to be nimble and flexible at moving data between X, Y & Z, maybe running a few ad-hoc queries in the process.

    (I would be running Linux on my laptop if it wasn't for the issue of MSAccess.)

  9. Re:from the is-there-anything-it-can't-do dept... on Graphene Super Paper Is 10x Stronger Than Steel · · Score: 1

    I want to know if a Ginsu knife will cut it and a tomato with the same ease.

    [Gee, I'm old... now get off my lawn!]


    The new take on that is now the "Yoshi Blade" which is a ceramic knife. (And a laundry list of "do not do this, that or the other thing with the blade". Along with S&H charges that are almost twice what you supposedly pay for the knife.)

    Another decade, another scam.

  10. Re:Identify the strike zone? on Robot Throws First Pitch At Phillies Game · · Score: 1

    Fellow sad Mets fan.

    I was at the Thursday double-header the other week and was highly amused by the fan attempting to start a "Bernie Madoff" chant.

    Maybe the Wilpons will be forced to sell...

  11. Re:Kind of makes you wonder... on Open Source Programming Tools On the Rise · · Score: 1

    Case & Point: I purchased

    "Case & point"? Are you planning on casing the joint, then pointing at it?

    Try "case in point". Because using an idiom twice, with it incorrect both times, really ruins any point that you hoped to make.

  12. Re:"Good Enough" is the enemy of "Better" on Why Has Blu-ray Failed To Catch Hold? · · Score: 1

    Even back during the VHS -> DVD transition there was horrid mastering going on. Lots of DVDs were shipped out using poor encoders, crap authoring software and/or just too low of bit rates.

    Some of the publishers seem to have a severe lack of QC going on.

    And there were firmware issues back then too. The Matrix DVD had menus that would hang certain older DVD players.

  13. Re:Wake Me When They Change The Name on GIMP 2.7.2 Released — Another Step Toward 2.8 · · Score: 2

    Does anyone really care about this anymore? Everyone I know who has started using the GIMP had a chuckle about the name, then really forgot about the name and got on with editing photos.

    Yes, people still care. Anyone in a position of power is not going to allow this due to the name. Lots of people find the name offensive / or too risky so it will never be installed. To the point that they would rather pay money, then to use GIMP. Heck, there are developers that won't touch the source code because nobody wants that on their resume.

    The developer's choice to stick with the name can only be seen as the blatant stubbornness of a 3-year old throwing a tantrum. The issue is never going to go away. Even if they stick their head in the sand for another decade.

    Grow up, change the name.

  14. Re:Still too pricey per gig for mass storage on Intel Replaces Consumer SSD Line, Nixes SLC-SSD · · Score: 1

    The question arises then, why not? What possible need could they have to actually restart the laptop of an average user so often that it would matter?

    Maybe because hibernate and standby still often don't "just work"? Even a decade later it can still be hit/miss.

    The only machines that I've ever seen near-bulletproof sleep / standby / hibernate were the older Mac laptops where hardware was extremely homogenous.

  15. Re:Still too pricey per gig for mass storage on Intel Replaces Consumer SSD Line, Nixes SLC-SSD · · Score: 1

    I know of a large company that is starting the switchover. They calculated that removing the loss in productivity caused by long OS startups more than easily pays for the cost of switching to SSDs. The math that you might use on your home computer doesn't always apply in the business world.

    It's pretty close to that point. The magic number for us is about $1.50/GB since we'll be wanting a minimum of 128GB drives. If we can pick those up for under $200 or so, it will be worth it. I still say $1/GB is the magic number.

    (64GB for $120 just isn't quite a large enough drive for our needs.)

  16. Re:Still too pricey per gig for mass storage on Intel Replaces Consumer SSD Line, Nixes SLC-SSD · · Score: 1

    Hmm... Hard to say, hard to say. Personally, I'm thinking more like $.10 per gig. As you mention, HDs are currently around $.05 per gig. I bought a 60gig SSD a while back, it's just not big enough - it constantly forces me to shift stuff to the HD(I LOVE symbolic links!). I can keep the OS, a few applications, and maybe a couple games on it. Performance improvements, at this point, are almost unnoticable. Personally, I think that a hybrid SSD/HD [storagemojo.com] solution is currently the best idea, at least for the common user. Though I think I'd prefer 8-20 Gigs of flash cache, not 4.

    No, I also put the magic number at $1/GB for mass acceptance. If I could pickup 128GB SSDs for $100-$150, we'd swap out every hard drive in the office machines next quarter.

    The current price is around $1.70-$2.00 per GB right now, and it's right on the cusp of being cheap enough for large enough that people will switch. Now that you can pickup 64GB SSDs for $110-$120, I'm seeing a lot of people saying "why not?". For business laptops, it's definitely to the point where SSDs trump old-style 5400/7200 RPM platters.

  17. Re:Treat it like any other secure system on Confidential Data Not Safe On Solid State Disks · · Score: 2

    If you are that concerned about the security of your data, then you either encrypt all of your data, in which case it probably doesn't matter what happens to the drive after you get rid of it; or you destroy the drive and suck up the cost of a new one (or you are a large customer, and have an agreement with the vendor which allows you to destroy the drive and get a replacement). Security, convenience, or low cost---pick one.

    Exactly. Large companies generally have agreements to cover this. A lot of them just unscrew the cover plate off the drive that contains the serial number and model number information and only send that back to the manufacturer.

  18. Re:Definitely deserved on Civ IV's Baba Yetu Wins First Grammy For Video Game · · Score: 3, Interesting

    Key issues:

    - The really bad happiness mechanic.
    - Having more of a luxury resource was pointless after the first one.
    - Easily exploited city-states. To the point where they imbalanced the game.
    - Poor game balance at release. Just absolutely horrid game balance.
    - Really *realy* poor AI at release.
    - 1 unit/tile stacking sounds neat, until you try and work with it in the ancient era.
    - Game board is way too small. If you're going to do 1/tile unit limits, then you need 4x to 6x more tiles for the same area. So if the hexes had been divided up into 6 smaller hexes, it might have actually been viable.
    - Mass simplification of so many attributes of the previous game.
    - There was way too much "throw the baby out with the bath water" to the design of Civ5. The young hot-shot developers were given too much free reign to put their "stamp" on the franchise, rather then keeping them in check and developing a better Civ4.

    I played about 40-60 hours worth in the first few weeks. Wanting to like it, trying hard to like it, but ultimately it was a severely flawed Civ release. I'm not surprised that it got really shitty reviews on Amazon (last check, almost 600 reviews and it barely averages a 2.3 out of 5.0). Hell, there are 593 reviews and 279 of them are 1-star reviews.

    They need to fire the lead designer who did Civ5 and look long and hard at what people liked about Civ4 and work that into the next revision of Civ5.

  19. Re:Makes me glad I quit Windows years ago on Looking Back At Microsoft's Rocky History In Storage Tech · · Score: 1


    Software RAID does not require that all disks are the same size. If you have (3) 1TB drives and (2) 1.5TB drives, nothing says you can't create a RAID-10 across the first 1TB of all 5 drives and put a 0.5TB RAID-1 array across the back half of the 1.5TB drives.

    LVM2 handles everything else (it will also do redundancy if you want). And you can migrate LVs between PVs using the migration tools. So if you have a portion of your volume group on a RAID-1 array and decide that it belongs on the RAID-10 array in the same volume group, you just do an on-the-fly migration to the other PV.

    You can even do things like migrating LVs off the active disks so that you can rip them out and replace them with larger / faster / better disks, then migrate it all back.

    Without having to take the server down.

  20. Re:Its not the speed that is the problem. on Obama Calling For $53B For High Speed Rail · · Score: 1

    The problem is that Amtrak trains are very, very slow. LA-SF takes 12 hours. It takes 6 hours by car driving the speed limit. They also cost just a bit less than airplanes. The major advantages of Amtrak are lack of security and the space. Sadly, for high speed trains, I'm sure the first will be removed, and who knows about the second.

    And it's generally not that the trains are slow, it's that the train has to deal with:

    - Slowing down for poorly maintained sections of track that limit speed.

    - Slowing down for grade level crossings.

    - Slowing down due to a really slow moving freight train up ahead.

    - Slowing down and stopping at every podunk little town along the way. (There needs to be an "express" train and a "locals" train, but that tends to only work in places like the LIRR.)

    Passenger diesel can easily hit 60-80mph on well maintained tracks. And the electric engines between Philly and NYC hit 80-90mph. It's all the other nonsense that slows things down.

  21. Re:Yet another idiot story. on Are You Sure SHA-1+Salt Is Enough For Passwords? · · Score: 1

    It's nothing new.

    The reason you hash is to avoid handing an attacker your passwords on a silver platter. The reason that you salt prior to hashing is to prevent a rainbow table from one attack being used again on another attack.

    But we've known for a while that it's possible with cloud-computing, or multiple boxes with quad SLI/Crossfire, or a bot network, that you can easily solve a few million hashes per minute for not a lot of money. Anything of 8 characters or less, even random gibberish is basically child's play at this point. If the attacker has the hash value, and your users are using weak/short passwords, they're going to crack the passwords in under a day.

    The only defenses against that are:

    - Use a heavier hash algorithm (more CPU time) or iterate. Both are losing battles as the attacker can scale up their resources a lot faster then the defender.

    - Don't let the hashes into the hands of the attacker. Force them to go through a server-side process and install rate-limiting and lockouts on that process (which is the approach that SSH takes).

    - Force your users to use stronger passwords.

    Right now, a safe password length is 9-10 or longer, with at least some non-lowercase letters mixed in. Ideally, you should be using something in the 12-15 character range with numbers, symbols and mixed-case. Make your users memorize stronger passwords, and stop requiring them to change it every 30-60 days (which breeds laziness and bad habits and really bad passwords). Change your systems so that they check password complexity before allowing a new password to be put into use.

    And if it's a really big deal - start considering adding a 2nd form of authentication to the mix (i.e. key fobs + passwords). Note that you do not *replace* passwords, but you augment them with a 2nd form of authentication. (See "two-factor authentication", which is a 30-40 year old concept at this point.)

  22. Re:Marking Coffee? on Office Robots of the Near Future, Gearing Up · · Score: 1

    You're off by an order of magnitude.

    $175k/yr at 60 hr/week for 50 weeks is only $58.33 per hour.

    But humans don't function well, working 10-12 hour days, 5-6 days per week, without any breaks mid-day or mid-morning or mid-afternoon to get up, walk around, get the blood flowing, and go for a cup of coffee. So there's going to be at least 30-60 minutes of downtime in every 10 hour day anyway.

    But then I guess you could always argue against lawyers being counted as human...

  23. Re:Typical applications? on Cassandra 0.7 Can Pack 2 Billion Columns Into a Row · · Score: 2

    I've been in the business for more than two decades, and I have never ever encountered a situation where I need 256(!) columns. True, I have worked mostly in tech/business sectors, and that's why I asked the question: what sorta application need so many columns.

    Data collection where you are reporting across samples (averages, means, group by) but where you are collecting dozens or hundreds of generally unrelated attributes for each sample. Some attributes might be related, but only loosely, other attributes are completely distinct from the other attributes. Because all of the attributes need to map back to the sample ID, there's no point in creating lots of different tables unless you are forced to due to database constraints. Plus the users want to be able to scan across the columns and down rows to spot patterns, so storing as "sampleID-attributekey-value" triplets means you have to do a lot more work in the presentation layer, converting it back to a "sample-attr1-attr2-attr3" style.

  24. Re:Typical applications? on Cassandra 0.7 Can Pack 2 Billion Columns Into a Row · · Score: 1

    What sorta applications need so many columns? Curious.

    Sample collection data where you are collecting a few hundred individual loosely related (and often completely unrelated other then the sample number) attributes per sample. For the most part, due to a lot of databases having a 255 column limit, this means you have to have multiple data tables. Which may or may not be a problem depending on how you need to report the data.

  25. Re:AMD CPUs all over the place on AMD CEO Dirk Meyer Resigns · · Score: 1

    AMD chips always ended up seeming to require excessive cooling

    I'm really not sure what you've been smoking, but I suggest you stop.

    The last "hot" AMD chip I had was back in the original 1GHz Athlon days, circa 2000 or 2001. It got that reputation mostly because it was about the point of the time that Intel added on-chip thermal regulation and AMD hadn't yet. So if you pulled a heatsink off a Intel chip, it would clock itself downward to compensate. The AMD chips, which didn't yet have that feature, would fail (spectacularly).

    All of the Athlon64 and Opteron CPUs since then have included thermal regulation circuitry. It's been a non-issue for both manufs since '02 or so.

    Back around '03 or so, AMD shifted their processor feature size down to 90nm (or was that the 65nm shift?). That allowed them to ramp up performance and turn down TDP (thermal design power). During the last 6 years, they've had CPUs that run on as little as 45W TDP, with 60W TDP chips being extremely common. Only the more powerful CPUs run at 90W or 125W now.

    Guess what? Intel *also* has chips in the 90-150W TDP envelope. They both consume about the same amount of power, require the same amount of cooling (a lot) to dissipate that much heat, etc. Have you forgotten how loud and hot the old Pentium IV chips ran? Apparently so. Because the rest of us were getting equivalent performance out of AMD Opteron/Athlon64 chips that ran a dozen or two degrees cooler, requiring less fan noise to keep things running. The Xeons have been more hit/miss compared to the Opteron, and Intel was using a different calculation for TDP which also muddied the waters.

    But for the last 6-7 years, you had a choice with both Intel/AMD. You could buy the 125W (or higher) part for maximum performance, or go with one of the 60-90W parts which required only very modest cooling fans and heat sinks. And there have been select 45W parts from AMD that let you get by with stock CPU coolers/fans that are near silent. Even the 60W parts from AMD come with stock coolers/fans that are nearly silent now and it is typically the GPU card that ends up making most of the noise in a modern system.