Slashdot Mirror


User: Antique+Geekmeister

Antique+Geekmeister's activity in the archive.

Stories
0
Comments
7,305
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 7,305

  1. Re:it's a great idea with one major flaw on Tox, a Skype Replacement Built On 'Privacy First' · · Score: 1

    > You can quite easily turn off iCloud and use whatever service you want

    I'm afraid I must say "good luck with that". The bar to replace services that are built into Iphones or Ipads by Apple, as a supported service and built directly into their operating systems, is quite high.

  2. Re:Someone got paid off on Wi-Fi Router Attack Only Requires a Single PIN Guess · · Score: 1

    Good for you, then, that you are doing real work in the field. I'll applaud your technical work in discovering and publishing this vulnerability, and I hope you'll feel able to publish more details ASAP{.

    As you are actually doing security work I'll urge that you be aware of why and how people might use your practice of genuinely responsible disclosure against their own customers or clients. There often comes a time when you have to make choices about whistle-blowing: exposing the flaws more widely to force change, or to protect potential victims. It can cost you business to do so, as well, which is a real financial incentive not to publish even if no one actually pays you for your silence. I'm afraid that I'm often bound by contracts and NDA's from disclosing security problems even to other departments of the same company: they're not part of the group I'm contractually working with, so I can't notify them directly of the problem.

    There are often legal, ethical, business and technical issues that I face regularly that can distort 'responsible disclosure', so I do hope you're more aware of them in the future for your own work.

  3. Re:Someone got paid off on Wi-Fi Router Attack Only Requires a Single PIN Guess · · Score: 1

    >> We call this responsible disclosure.

    > are you accusing me of being a liar

    I'd not done so. I don't discount responsible disclosure as existing: I'd certainly want to see a zero-day exploit reported to the authors, first, so that they can get a chance to publish a patch before the flaw spreads in the wild, and I _report_ flaws directly to vendors and authors when I encounter them.

    I've explained other, more selfish reasons that a vendor or a security researcher might decline to publish full details, reasons that could be and often are hidden behind the explanation of "responsible disclosure". Ignoring such motives would be naive. Vendors can, and do, hide behind rubrics of "responsible disclosure" to avoid the effort, especially significant redesign efforts, to actually fix the problem. Microsoft and CERT are the classic example of this. Microsoft product flaws are reported to CERT and remain undisclosed, for years, under "responsible disclosure" policies that provide little incentive to actually fix the dangerous, longstanding flaws..

    I've certainly seen the problem personally when reporting or trying to fix security flaws. Given the length of my career, I've even seen architectural security flaws that have never been fixed because they would force a change in workflow, and that was unacceptable to the vendor or to the users. And I've had numerous business partners I've worked with get upset when I disclosed their security vulnerabilities to their own engineering staff, who'd not reviewed the consequences of their choices or had been deliberately kept out of the loop by their own supervisors.

    Your immediate response of "are you accusing me of being a liar" is.... well, it seems based on my thinking that you actually work in security. I'm afraid that based on your apparent naivete, I can't conclude that. The idea that claimed "responsible disclosure" is always just that would be frankly naive.

  4. Re:Does this office need Congressional approval? on Google's Megan Smith Would Be First US CTO Worthy of the Title · · Score: 2

    Like racial, national, religious, and age discrimination, gender discrimination can often be hidden behind other practices. The old Youtube video about hiring only H1B candidates is an excellent guideline on how to hire only members of your preferred social groups. ( https://www.youtube.com/watch?... ) Simply fillin your preferred gender, age, skin color, religioon, or nationality for the word "H1B" in the presentation.

    One of the most powerful forms of gender discrimination in the technology world is the inevitable discrimination against mothers who need maternal leave, or women who may become pregnant. Illegal or not, it colors every hiring review of younger women, for logical even if illegal reasons.

  5. Re:Someone got paid off on Wi-Fi Router Attack Only Requires a Single PIN Guess · · Score: 2

    It can also protect profits to make sure that the announcement of the vulnerability smears all vendors and thus includes your competitors tools, not merely your own company's flawed products. This is called "sponsoring more research before publication". I'm afraid that it's a noticeable source of funding for security researchers, and can also buy valuable time to sell off as much of the flawed inventory as possible while or until the fix is provided for newer products.

    I'm afraid that there are people who think this way, putting their short term corporate sales well before customer safety or product quality. And their ability to preserve profits, and to _hide their failures_, can often lead them to positions of great corporate power.

  6. Profit centric, not customer centric on Microsoft Defies Court Order, Will Not Give Emails To US Government · · Score: 2

    > Let there be no doubt that Microsoft's actions in this controversial case are customer-centric.

    Nonsense. It is protecting their millions, even billions of dollars of international business, especially for their hosted email services, to make a public display of fighting this court order. It also helps protect their US business: publicly refusing a US order helps provide a history of customer privacy awareness when they try to resist a Chinese or Russian or EU court order for US held data.

    And this is not an NSA "Patriot Act" order, which don't require judges and can be far, far broader than a typical search warrant or subpoena.

  7. Re:interesting case.... on Fake NVIDIA Graphics Cards Show Up In Germany · · Score: 2

    For the packaging, make a deal with whoever cleans up at an assembly line for desktops. Plenty of PC vendors wind up with pallets of packaging to dispose of.

  8. Re:Wait... on Comcast Tells Government That Its Data Caps Aren't Actually "Data Caps" · · Score: 1

    Verizon, in mot cities I've visited lately.

  9. Re:Do the math on New EU Rules Will Limit Vacuum Cleaners To 1600W · · Score: 1

    I've no objection to getting a better tool for that specific job. They're still electrical heating elements, so they're still using roughly 100 Watt for a typical car or truck engine.

    Their main disadvantage is that they tend to have an electrical plug you have to fish out and connect at night, and put back safely in the morning. People tend to forget them and drive off with them connected, then rip the cord off. So what I've personally recommended to a few people is this.

                        http://www.amazon.com/US-Wire-...

    The cord is bright orange, obvious sticking out from the hood, and 25 feet long, The hook on top is also very handy for storing it away safely when you take it out from under the hoood. it's very useful for seeing what you're doing from _under_ the car when working, as well, and if you have to you can still put a compact flourescent bulb in it. That didn't used to work well, but some of the flourescent bulbs are small enough now.

    It's not a perfect solution, but it still works quite well.

  10. Re:Why? on Virtual Machine Brings X86 Linux Apps To ARMv7 Devices · · Score: 1

    > This allows wine to run on exotic hardware. (Well, at least ARMv7)

    Except that it doesn't. Do check the compatibility ratings at https://appdb.winehq.org/, and select for the word "garbage". Sadly enough, even the compatibility site itself is quite horrible. Like maintaining Wine itself, it requires manual drilling down into individual components to get any useful information about them.

  11. Re:Do the math on New EU Rules Will Limit Vacuum Cleaners To 1600W · · Score: 1

    And they do have uses. There are places where the energy output is the _point_, such as putting a shoplight under the hood of your car, to keep the engine from freezing solid, in very cold winters. There are also electronic measurement environments where the high frequency signals of the flourescent electronics get into the power lines and the local ground lines, and _cannot_ be effectively filtered out. So you use 60 Hz incandescents for lighting, or even tun incandescent lights off a battery power supply.

  12. Re:I'd love to be in his class on Professor Steve Ballmer Will Teach At Two Universities This Year · · Score: 1

    > it's not that hard to find a loyal customer

    Then please, do name one. Please don't say "it's easy to do". If it's that easy, feel free.

    > But there's a fair number of people who said they really liked their Zunes just for playing MP3s (back when they used them), they just didn't like the crappy sharing feature or the MS music store or the way MS screwed up "PlaysForSure".

    I'm afraid that you've just reinforced my point.

  13. Re:I'd love to be in his class on Professor Steve Ballmer Will Teach At Two Universities This Year · · Score: 0

    > It would appear that the only place he failed is in your mind.

    I'm afraid that Mr. Ballmer was considered a liability by various stock analysts and stock holders by the end of his tenure. The failures of the smartphone, Zune media player, Surface tablet and Windows 8 to make their sales goals or to generate loyal user bases were demonstrable failures of his leadership. I'll challenge you to find _one_ loyal customer of any of those products, one who actually prefers it to an Iphone, Ipod, cheap notebook, or Windows 7.

    Compounded by the failure to complete the migrations from Windows XP for thousands of businesses worldwide, he created grand visions for a series of failed projects. So yes, he became a failure in many stockholders' minds, as well.

  14. Re:reality check on Smartphone Kill Switch, Consumer Boon Or Way For Government To Brick Your Phone? · · Score: 2

    Blanket bricking of cell phones, or selective bricking of those of "ringleaders", is an inevitable problem for the most peaceful and well behaved political rally with this kind of technology in government hands. Remember the "Arab Sping", and Tianenmen Square, and even the more recent and quite peaceful "Occupy Wall Street" protests.in the US, and understand exactly why and how law enforcement want this kind of power.

  15. Re:Patent Trolls arent just little companies on How Patent Trolls Destroy Innovation · · Score: 2

    > Fixing this mess won't be easy.

    Fixing the mess is at least straightforward. Discard software patents. Their legality has always been questionable, for sound technical and legal reasons, and they're one of the greatest drains on the patent office. They also have profound, demonstrable adverse effects on industry and on innovation in practice.

    Implementing that legal and policy change will not be easy, I agree.

  16. Re:Trolls or Not Trolls on How Patent Trolls Destroy Innovation · · Score: 3, Interesting

    > The original purpose of Patents to create a period of exclusivity to regain the expense of research, tooling (and other capital risks), are good.

    That benefit can often, not always, be retained by simply keeping a trade secret. The corresponding social benefit of limited patents is that they expire, and the invention is then available to the public.

    Unfortunately, the patent office, and the patent system itself, is overwhelmed by software patents. These are by their nature nebulous, aggressive, and often overlapping in complex ways. They also open the doors for, yes, patent trolls, who do no innovation and produce no actual goods or services to the general public. They exist purely as legal entities to file lawsuits based on patents they've purchased, and have no history or intention of using themselves.

    The ideal solution is to discard software patents altogether. They are a horrific drain on software design and productivity, not merely due to patent troll losses, but because they force companies to invest thousands or millions of dollars in patent suites to protect from potential patent litigation. And they directly interfere with software authors publishing their work as open source or freeware. The corporate lawyers, and the expense of patent review, cause many companies to refuse to publish even patches to open source, or freeware. There are good reasons the GPLv3 has tried to deal with software patents harshly. They've been a real problem with open source and freeware.

  17. Re:Not much of a fix on ICANN Offers Fix For Domain Name Collisions · · Score: 2

    > WHAT THE FUCK made you create these new TLDs in the first place? Did you just pull some TLDs out of your ass and say 'great plan' and only AFTER saying you would create them start to think about the impact?

    ICANN charges the registrars, and the registrars collect money for people registering their domains across all domains for simple fraud protection or trademark protection. I'm afraid that the domain registration business is aimed at the domain squatters, since they easily squat the domains _just_ when you try to register them and release them before they have to pay fees, if you don't follow up and buy them. The remainder that do get registered, and the defensive registration of the same name across multiple domains, is where ICANN gets funding.

  18. Re:What's the problem... on Apple Begins Storing Chinese User Data On Servers In China · · Score: 1

    > What a silly-assed thing to say. Sure, they could order it. And Apple could completely ignore them

    Then China can, and will, close the server farms in China. Or arrest the managers in China for the equivalent of "contempt of court".

  19. > I'm glad that was made clear, us nerds know very little about IT in reality

    I'm afraid that you're quite right. Many of our nerd friends and colleagues keep their SSH private keys un-passphrase-protected on backups and on NFS shares or removable media, we leave defaults in place for SNMP access. Moreover, a majority of the companies I've worked with in the last 10 years rely on their external firewalls to protect their internal networks from monitoring. This is even though people with VPN and laptop access connect to those internal networks all the time.

    More generally, the Windows admins and most developers don't generally need to or try to understand how other protocol works. They click a few boxes on their configuration tools, they read a Google how-to, and that's the extent of their review. They don't bother to ready the man pages or do an "snmpwalk" because they don't _have_ to.

    And it's not just the Windows admins or software developers. I spent an hour on Thursday walking a senior Linux administrator through SNMP. He'd never realized that SNMP was the core tool for scanning remote network devices. I could explain why, but that's a separate post.

  20. Re:Version control on Switching Game Engines Halfway Through Development · · Score: 2

    I've used all of them, quite effectively. Sorry, but Perforce's overly centralized control and the administrative expense of error prone Perforce management makes it unusable for long projects. The centralized control is too vulnerable to central administrator errors, such as having to delete content and accidentally deleting the only copy. Subversion has some similar issues, and relatively poor performance and very confusing upgrade cycles to deal with.

    Git is working out _extremely_ well for small and large projects in my experience, and its ease of replication and offsite management are far superior. Bitkeeper is comparable to git in performance but now badly lags in cross-compatibility features and broadly available hosting resources like github or bitbucket.

  21. Re:Rise of the middlemen on Switching Game Engines Halfway Through Development · · Score: 1

    That's a ludicrous "version control" fee. Given that you have to set procedures anyway, for effective work flow and creating production releases, it sounds like someone made a mistake in the licensing. What feature could it possibly be adding when you can do robust software management and collaboration at github.com, bitbucket.com, or any of the git repositories with commercial support services?

  22. Re:Hmm? on Twitter Reports 23 Million Users Are Actually Bots · · Score: 1

    I'm afraid to say that your failure to see how the failure to see how the older, phone based system can break down does not match my experience. The SMS system breaks down in numerous ways for high volume alert systems, and the systems that _send_ the pages are often lightweight in-house systems vulnerable to failure. The tendency of most such systems to send each page with its own unique, unidentifiable, sequentially identified number also makes it dificult if not impossible to _group_ the messages. 100 such messages means they come from 100 distict ids: it's unmanageable for high volumes, and it's not accessible from a webapp or more effective user interface to review and expire them by groups.

    Personally, I use Twitter _only_ for a work account that is published nowhere and subscribes only to a work related alert system. It's not Twitter's usage model, because it collects no personal data and gets no noticeable advertising advertising revenue. But it's far more reliable than SMS has proven, especially with the fragile and poorly maintained alert to SMS paging systems.

  23. Re:Hmm? on Twitter Reports 23 Million Users Are Actually Bots · · Score: 1

    > Why in the world is this the business of SEC?

    Because the anticipated market value, growth, and revenues of Twitter are based on models of human behavior and human subscription. A 20% growth of Twitter's user base is great news for Twitter, as a company: but if that 20% is made up of 50% spambots who don't pay their bills, they're not a revenue source and shouldn't be counted as such in Twitter's business statements to stockholders or other investors. At the end of the business day, a working business needs paying customers, not just an "exciting paradigm shift". I'm afraid that entrepreneurs and investors lost sight of this during the dotcom craze. They rode a tidal wave of excited investment money, and they spent it without a matching return. The SEC is therefore now being more cautious about company's financial reporting, especially their extrapolated growth. And botnets don't usually pay their bills.

    I will note that there are useful bots on Twitter. Automated SMS text alerts, for example, have turned out to be much slower, much less reliable, and much more difficult to organize than a well crafted Twitter feed. Given the option, I'd replace any high volume alert paging system with a twitter feed at the first opportunity.

  24. Re:Terry Pratchett has Alzheimer's on Experimental Drug Compound Found To Reverse Effects of Alzheimer's In Mice · · Score: 1

    I suspect that Mr. Pratchett would be somewhat grateful, though finely appreciative of any irony, if he's still in condition to do so. A lot of his stories contain tough choices, and struggles with amazing burdens. If he decides to go this way, I hope someone can find an orangutang to hand him a book to read to sleep.

  25. Re: And so it begins... on Babylon 5 May Finally Get a Big-Screen Debut · · Score: 3, Interesting

    Part of the "jumping the shark" was due to money craziness, and the problems when core actors decide they need to do other things with their career. The switch of captains was an enormous problem for fans and the story line, but we'd come to terms with it. The switch of first officers as well, was crippling.

    The reboot of Star Trek was, admittedly, a failure. It lacked Gene Roddenberry's vision of the future as a better place as a more mature place and time with a frontier that tested and showed people who'd learned to engage frontiers with the hard-won wisdom they'd learned, who were actually making the galaxy a better place by sharing that wisdom But I was personally very pleased with the "Enterprise" series as an attempt to restart the series in an earlier period and recapture the exploration of a less mature series.

    And for Star Trek/Babylon 5 comparisons, there can only be the Deep Space 9/Babylon 5 comparison. Anyone who didn't see parallels simply wasn't paying attention, and it was fascinating, as fans, to see how much better of a storyline Baboylon 5 was, and how much having a larger studio and a larger budget and franchise was able to help Deep Space 9. I really found myself wishing that Paramount, JMS, and the remainders of Gene Roddenberry's core crew and estate could have worked something out for Babylon 5 to have been told in the Star Trek universe with the larger budgets and resources.

    I'm forced to admit that as a fan, I was delighted and thrilled to see Majel Barrett-Roddenberry, renowned as Gene Roddenberry's supportive wife, as Nurse Chapel and Lwaxana Troi and the voice of all the computers in Star Trek, pop up as the wife of the emperor in Babylon 5. It was wonderful to see the woman, herself, show her support of the excellent work at Babylon 5 by appear in a small bit fascinating role.

    And Walter Koenig's hop from roles as Chekov in Star Trek to Alfred Bester in Babylon 5 was... well, you have to go watch the shows to understand the _completely_ different role Walter Koenig plays, and to applaud the acting and the writing that created it.