Slashdot Mirror


User: chrootstrap

chrootstrap's activity in the archive.

Stories
0
Comments
37
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 37

  1. Re:Why? on Brits Still Working on Stinky Email · · Score: 1

    hahahha... that was the most interesting and funny idea I've heard all day. Thank you! :)

  2. Re:Linux 2.6 infringement free?? on SCO Lists Specific Code-Infringement Claims · · Score: 5, Interesting

    In the groklaw article, several of the tables are in reference to the 2.6.0 kernel code.

  3. Re: Not running as Admin or Root != safe on Exploit Based On Leaked Windows Code Released · · Score: 1

    "Of course, I wouldnt call such a thing "secure", since it then becomes trivial to distribute a program which prompts for administrative password, then says "incorrect password" and goes on to display the real password box. Later asking for an e-mail address, coupled with people tending to use the same password everywhere- well, making things easy and making things secure is always going to be a trade-off somewhere."

    Hahah... you're keyed into one of the most serious security gaps in user habits: using the same password everywhere. This has really been compounded by the way so many websites require username/password. If joeblow/drowssap makes an account at mydumbsite.com and I can find anywhere else he has an account (e-mail, slashdot, ebay, paypal, ...) there is a reasonably good chance that the password will work. Of course, as you crack one thing you tend to learn more access; the webmail yields a power bill, etc.

    I personally believe in partitioning security into more than one level (analogous to guest/user/root) and then, of course, applying much stronger security (particularly encryption) up the chain. Of course, one of the things that helps with security the most is knowing what the heck the system is doing inside; there is a strong argument for having the source available right there. People who are blaming the author of the securityfocus submission are misplacing the responsibility for these security flaw. As I said, this very type of crack was something I was just thinking about last week; undoubtably many people have experimented with tainted BMPs, etc.

    We are fortunate to finally know about it, honestly! :)

  4. Re:Open Source More Secure... maybe not on Exploit Based On Leaked Windows Code Released · · Score: 1

    lol... maybe, they change the name to BlackHat.

  5. Re: Not running as Admin or Root != safe on Exploit Based On Leaked Windows Code Released · · Score: 1

    The basic difference is that the admin or root account is generally used to install, modify, and delete/uninstall executable programs. While this doesn't always work perfectly (e.g. PATH=~/bin, executables (including plug-ins) owned by the user, etc), this goes a long way to protecting not only users but yourself as well. So, if the admin account hasn't been compromised, you should feel fairly secure that when you run IE it doesn't have a virus infection, backdoor, etc.

    I agree that user-created documents are generally more important to the user than some .ini file used by an input method, etc. However, that has very little to do with security. If the user wishes to secure those documents, then backing them up, etc, makes some sense, no? However, consider that very few worms/viruses actually trash systems these days. They'd rather be stealthy; stay hidden and exploit the user's computer. Restricting admin access will improve the security in that scenario.

    Personally, I like how seemless Mac OS X has made it such that, when you do need admin access, it simply prompts you for the password in a dialog. It's easy and secure.

  6. Re:huh on Exploit Based On Leaked Windows Code Released · · Score: 1

    Oh come on. He was giving an example of how crappy the Windows source was. He saw a vulnerability, tested it, and released code to test it. There was no "payload", no obvious malicious intent; it was an example. We've seen that kind of thing in free software all the time. If he was really such an ass he wouldn't have announced the discovery out of his clique on IRC, etc.

  7. Re:Open Source More Secure... maybe not on Exploit Based On Leaked Windows Code Released · · Score: 1

    Really? While the red security flag has been raised lots of times for things in Linux, I've only seen a handful or two exploits for the kernel itself. There are indeed hundreds for the various commonly-used software packages, of course.

    Could you give some examples?

  8. That's odd, I was just thinking of doing this... on Exploit Based On Leaked Windows Code Released · · Score: 1

    That's so wierd. Just last week I was thinking of crafting this very kind of exploit or one using a jpeg. Its interesting to consider how much blind acceptance of formatted data goes on... Perhaps a Word document could do such a thing as well, eh. A PDF? An Mpeg? lol... don't worry, it's not like people run as administrator all the time. ;)

  9. Re:I need something to read in the bathroom on Buying Boxed Games - Important To The Gaming Experience? · · Score: 2, Interesting

    I think you're absolutely right about the cover art of games. This reminds me a lot of why I always preferred vinyl records: the cover art, the record covers with all the lyrics, the art on the record itself. Speaking of old Ultima boxes, I happily recall the contents of my Ultima IV box, one of my all time favorite games: a metal ankh, a cloth map, a faux-leather bound spell book, and a couple of manuals, laden with fantasy-rich back story and TSR-style art. And, then there were boxes like Leather Goddess of Phobos -- they were the total package. It was so much fun to get a game and find there were lots of cool things inside. Nowadays, it's just cardboard and a CD, rarely even a manual -- the cheap bastards! :)

  10. Re:MOD PARENT DOWN on Cell Phone Is The Most Hated Invention · · Score: 2, Informative

    All fine and dandy, but I'm also the original author of the article.

    It may be a shoddy piece of writing, but the sentiment is fresh in my mind and on-topic.

  11. Re:I'm amazed that television didn't rank higher on Cell Phone Is The Most Hated Invention · · Score: 2, Insightful

    As for the 20th century, I've recently figured automobiles were the worst of the lot (though they were invented before 1900, it is much more the 20th century mass adoption with which I am concerned):

    Until about than one-hundred years ago, human beings lived without cars. Now, one of the most common indicators of industrial development is the prevalence with which cars are distributed among the population. In the US, the majority of households own a car, many having more than one. One of the rites of passages for our youths, is the acquisition and use of a driving license. Our cities are now designed primarily with routing for automobile traffic; foot traffic is verbotten in most areas of the roads and cyclists are highly confined when sharing the road with cars. The most natural of human exercises and one of the most unique human movements, walking, has now nearly disappeared from many people's lives. I want to point out some of the many reasons why I believe that cars have had the most destructive application of any of humankind's inventions. For while the most terrifying instruments of human creation, those used in wars, are of clear and prominent danger and thus in cautious application, cars have invaded our society to such a thorough degree as to appear ingrained.

    I hope that this examination will encourage you to consider whether you wish to partake in the apparent convienence and isolation of a car, having exposed some of the many costs of cars.

    (1) Car accidents take hundreds of thousands of lives every year. Traveling at speeds of 65+ miles (combining to 130+ in a head on collision) per hour in a 2500 lb metal frame is not an environment in which the human body evolved with regard to. In these types of extreme conditions, our bodies are utterly vulnerable. Upon an accident, the car itself can become a trap. Passangers who are stuck due to structural damage or who are unconscious are in a very dangerous situation, particularly if fire is involved.

    Pedestrians are considerably more vulnerable to the effects of a moving cars huge force. Accidents in which pedestrians are struck have a high fatality rate. And, accidents are not uncommon. The average person experiences several car accidents in their life. Car accidents are one the leading causes of death in our country, particularly among young people.

    These deaths are preventable. If people did not use cars, car accidents would not occur.

    (2) People do not drive very responsibly. For example, the desire for intoxication is an ancient human desire, also being present in other animals. We may socially disapprove of intoxication itself or certain levels of intoxication, but this disapproval has historically not been sufficient to prevent the occurrence, particularly among certain people. Yet, driving a car while under the influence of alcohol has been indesputedly shown as a causitive factor in accidents.

    People may not wish to move in an orderly herd. They may wish to go faster or slower. They may be angry, impatient, tired, distracted, or simply unaware of the danger their vehicle presents to themselves and the people around them. As their mode and focus changes, so does their driving manner. In many, many cases, people drive when their attention is suboptimal and when their driving responses may not be prudent.

    While we may point and say this or that behavior is undesirable, the real crux of the matter is that human choices and temperaments well within the range of normality are simply not compatible with safe driving. We can override the natural (safe) flexibility of human behavior, yet when we become so accustomed, so acclimated to traveling in a car, I believe that we tend to forget just how terribily dangerous a car actually is. An appropriate analogy of driving a car is shooting a gun at one end of a crowded park in an attempt to hit a target on the other end while avoiding hitting people who are walking in and out of the line of fire. Yet, people treat such an activity as though it was just as saf

  12. Please, read the patent... on URLs Patented, Domain Registrars Sued · · Score: 4, Insightful

    ...and see for yourself how techno-jargon and a tremendous effort at obfuscation through over-complexity passed this patent through the filter. CowboyNeal's pithy sentence describes the near totality of the patent yet the patent itself spews reams of steps, trivia, and jargon to hide as well as possible the actual application of the patent. What a bunch of bullshit!

    I think there ought to be penalties for the use of these nuisance patents. A judge then could not only strike down the patent's validity (which will obviously happen here), but could also impose a heavy fine to deter this kind of litigious crap from happening.

  13. Re:Christmas at Microsoft on Oscar Screener Leak Traced · · Score: 1

    But, what if someone else (1) copies it without your knowledge/permission or (2) forges your ownership of the item? And, what rights of privacy should you retain if you purchase media? Indeed, what rights do ownership imply (I understand that the context of my question is broader than the case in point)?

    The essential quandary is treating duplicatable information as a discrete item. Once we have made each issue of this information distinct then the possesion of information appears as a finite occurrence. Therefore, I think it is a regression from the highest possibilities of the 'information age': an inexhuastible and growing pool of collective information (rather like the internet).

  14. Re:except on Oscar Screener Leak Traced · · Score: 1

    I'm not contesting that the context of an oscar screener is different from a programmer, but you used this phrase:

    "If they don't agree with the NDA, they don't sign it, and don't accept the information (or movie)..."

    Thus, I was responding with regards to the more generalized use of NDAs.

    As to rms, he would have had to sign an NDA in order to learn the hardware interface to the printer. He was prevented from a very reasonable development goal by Xerox's insistence that he sign an NDA. The problem is when doing reasonable things that do not need to use 'trade secret' knowledge is prevented by a company requiring an NDA. The transgression of volition implied by 'force' may not be as clear as forcing a person to go to jail, for example, but are not as trivial as you have implied. When signing an NDA is the only option in order to write a driver for a piece of hardware that you have purchased then I think that describing the resulting option as 'choosing' not to use the hardware is inaccurate.

    Again, in the case of an oscar screener the situation is quite a bit different, but this has been an ongoing problem in the development of free software.

    Regards! :)

  15. Re:except on Oscar Screener Leak Traced · · Score: 1
    "NDA's aren't immoral, and they're certainly not forced on people in my experience -- they're the tool that you use to protect yourself when you're given someone special, early access to something in return for them agreeing to keep it secret. If they don't agree with the NDA, they don't sign it, and don't accept the information (or movie) that they would have received under the NDA."

    Hahaha... if only there wasn't the long saga of companies using NDAs to keep information that should be open, closed. I would highly reading (at least) the first chapter from the book Free as in Freedom:

    http://www.oreilly.com/openbook/freedom/ch01.html
  16. Re:Christmas at Microsoft on Oscar Screener Leak Traced · · Score: 1

    I think that's an interesting point. I am concerned about the way Palladium could be used to identify the origins of media. I think this has many privacy and security implications. While most EULAs' demands are hardly any form of respectable agreement in my view, the valid interest in privacy in this case would have had a heavy measure of honor. Yet, the fact that the named, prematurely condemned (to some degree) person may have been completely innocent of the charges is of grave concern both with Palladium and this more sensationalized instance.

  17. Re:Christmas at Microsoft on Oscar Screener Leak Traced · · Score: 1

    lol... I'm not refering to the action per se. What I'm trying to note is the way a pirated item was traced to a very specific person. In fact, someone else may have surreptitiously copy and distribute the media, yet the 'owner' is culpable. It is another example of loss of privacy due precisely to the goals of Palladium. If only people would be as interested in tracing the leak of Valerie Plume's identity!

  18. Christmas at Microsoft on Oscar Screener Leak Traced · · Score: 1

    Welcome to the wonderful world of Palladium! (different technology, same application)

  19. Torvalds vs. SCO's Proof on SCO Responds to OSDL Legal Aid Announcement · · Score: 2, Interesting
    from lkml:

    I spent half an hour tearing part of it apart for some journalists. No guarantees for the full accuracy of this write-up, and in particular I don't actually have "original UNIX" code to compare against, but the files I checked (ctype.[ch]) definitely do not have any UNIX history to them.

    The rest of the files are mostly errno.h/signal.h/ioctl.h (and they are apparently the 2.4.x versions, before we moved some common constants into "asm-generic/errno.h"), and while I haven't analyzed them, I know for a fact that

    * the original errno.h used different error numbers than "original UNIX"

    I know this because I cursed it later when it meant that doing things like binary emulation wasn't as trivial - you had to translate the error numbers.
    * same goes for "signal.h": while a lot of the standard signals are well documented (ie "SIGKILL is 9"), historically we had lots of confusion (ie I think "real UNIX" has SIGBUS at 10, while Linux didn't originally have any SIGBUS at all, and later put it at 7 which was originally SIGUNUSED.

    So to me it looks like

    * yes, Linux obviously has the same signal names and error number names that UNIX has (so the files certainly have a lot of the same identifiers)
    * but equally clearly they weren't copied from any "real UNIX".

    (Later, non-x86 architectures have tried harder to be binary-compatible with their "real UNIX" counter-parts, and as a result we have different errno header files for different architectures - and on non-x86 architectures the numbers will usually match traditional UNIX).

    For example, doing a "grep" for SIGBUS on the kernel shows that most architectures still have SIGBUS at 7 (original Linux value), while alpha, sparc, parisc and mips have it at 10 (to match "real UNIX").

    What this tells me is that the original code never came from UNIX, but some architectures later were made to use the same values as UNIX for binary compatibility (I know this is true for alpha, for example: being compatible with OSF/1 was one of my very early goals in that port).

    In other words, I think we can totally _demolish_ the SCO claim that these 65 files were somehow "copied". They clearly are not.

    Which should come as no surprise to people. But I think it's nice to see just _how_ clearly we can show that SCO is - yet again - totally incorrect.

    Linus

    For example, SCO lists the files "include/linux/ctype.h" and "lib/ctype.h", and some trivial digging shows that those files are actually there in the original 0.01 distribution of Linux (ie September of 1991). And I can state

    * I wrote them (and looking at the original ones, I'm a bit ashamed: the "toupper()" and "tolower()" macros are so horribly ugly that I wouldn't admit to writing them if it wasn't because somebody else claimed to have done so ;)
    * writing them is no more than five minutes of work (you can verify that with any C programmer, so you don't have to take my word for it)
    * the details in them aren't even the same as in the BSD/UNIX files (the approach is the same, but if you look at actual implementation details you will notice that it's not just that my original "tolower/toupper" were embarrassingly ugly, a number of other details differ too).

    In short: for the files where I personally checked the history, I can definitely say that those files are trivially written by me personally, with no copying from any UNIX code _ever_.

    So it's definitely not a question of "all derivative branches". It's a question of the fact that I can show (and SCO should have been able to see) that the list they show clearly shows original work, not "copied".

    Analysis of "lib/ctype.c" and "include/linux/ctype.h".

    First, some background: the "ctype" name comes "character type", and the whole point of "ctype.h" and "ctype.c" is to test what kind

  20. Re:Many of the arguments against ET life disproven on Lonely Planets · · Score: 1

    Well, the first signs were from quite a while ago:
    http://www.pbs.org/wgbh/aso/databank/entries /do53a m.html

    But, there have been many advances:
    http://amesnews.arc.nasa.gov/releases/2 002/02_33AR .html
    http://www.space.com/scienceastronomy/gener alscien ce/neogenesis_scitues_010501-1.html

    Now biotechnologist are synthesizing life without ancestory:
    http://www.nature.com/nsu/031110/03111 0-17.html

    Further clues come from the deep sea vents, which also display how chemosynthesis may allow life in unusual places:
    http://www.pbs.org/wgbh/nova/abyss/life/e xtremes.h tml

    I think the evidence is quite good! Much of what we know about Earth's historical evolution can't be empirically tested; I think we can be more certain that life can spontaneously arise than many other commonly held beliefs.

    It is interesting to me, also, that life is so tenacious. It has adapted to complete atmospheric chemical changes, periods of mass extinctions, severe temperature fluxuations, etc. I think once genetic life occurs, it tends to stick around -- kind of like invisible stains:
    http://www.nbc.com/nbc/The_Tonight_Show_w ith_Jay_L eno/headlines/H_2571/13.html

  21. Many of the arguments against ET life disproven... on Lonely Planets · · Score: 2, Interesting

    There have been many arguments against the likelihood of life on other planets that have been disproven. For example, we now know with certainty that planets outside of our solar system exist and primitive life can indeed be created spontaneously from environmental conditions present on other planets.

    If the conditions are similar, I believe that there would see some of the same convergence of traits that we see with Earth's inhabitants. Yet, how far do we have to look to see the miraculous diversity of life, the amazing phenomenons such as endosymbiosis, and so on? In recent times, many old myths about the unique capabilities of human intelligence have also been disproven. Our definitions of intelligence would really need to be carefully considered in light of life from a different lineage -- indeed, our very definitions of life would probably need to be revisited!

    However, I think the pursuit of extraterrestrials tends towards anthropomorphization to the extreme. I don't think people realize how differently technology (culture) and 'science' can be interpreted. Any presumption that aliens would have encountered a similar 'age' of near-nuclear war, development of radios, etc really needs to be checked. We are just looking for ourselves! I also think that the likelihood that we are going to pick up and understand a legible, life-generated radio signal from outside of our solar system is exceedingly remote.

    On the other hand, I think exploring the possibility of historical life on mars with Spirit, etc is an excellent measure!

  22. Re:Output implies input on Secure Programmer: Keep an Eye on Inputs · · Score: 1

    lol! okay, fair enough, though the output ('input') could end up in /dev/null. :)

  23. Re:No inputs = useless? on Secure Programmer: Keep an Eye on Inputs · · Score: 1

    I don't think that every system call should be considered an input in this case. The kernel is not merely another process (though microkernels blur thus considerably), but an integral and originating part of every process. A monitor can be very useful without ever getting input from another process, but only accessing the kernel. Particularly, the stating of 'no input = secure' indicates said context as the kernel is nearly always assumed secure.

  24. Re:No inputs = useless? on Secure Programmer: Keep an Eye on Inputs · · Score: 1

    I don't think that 'input' should include every system call to the kernel (including output-focused ones, as they return errno, etc), which are the bare essentials used by many monitors. imo, the kernel should rather be seen as the originating program with its processes like procedures which it calls. We can generalize 'input' further, including the results of functions, or even every register and value passed to machine operations, but I think it would be sophisticated. The article is talking about inputs that are not originating from the kernel, but from other processes through mechanisms such as file streams and environmental variables. We are talking about process-to-process input/output, not intraprocess or process-to-kernel input. As such 'input' is not required to make a useful and interesting program. Furthermore, there are many significant mathematical uses for programs that do not make use of even system calls in order to derive their parameters; calculating large prime numbers for example.

  25. Re:No inputs = useless? on Secure Programmer: Keep an Eye on Inputs · · Score: 1

    A simulation can be perfectly useful though the data and lenght of operation has been hard coded into it. Another useful type of program without input are system monitors and watchdogs -- perhaps specifically for security purposes. If a language makes it quick and easy to create simulations (e.g. the 'R' language) with hard coded parameters, then the desire to reuse a program using different parameters may be lessened.