Slashdot Mirror


User: pushf+popf

pushf+popf's activity in the archive.

Stories
0
Comments
236
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 236

  1. That's easy on How To Manage a Security Breach? · · Score: 1

    Your friend needs to realize that he consults on technology, not business.

    He needs to inform the company that an unknown amount of their data, somewhere between 0% and 100% has been stolen and or changed, and recommend that if they want to stop this, they need to change or upgrade their workstations and network security.

    For an immdiate badn-aid, he can recommend that they all be unplugged from the network, but this will not fix the damage or prevent more when they're plugged back in. Then send them a bill and go home and relax.

    Whatever the company does with that infomation is up to them.

  2. Re:Everybody can't hire the *best*... on Hiring (Superstar) Programmers · · Score: 1

    The problem with that argument (and please don't think that I'm implying that this reflects on your abilities in any way) is that many companies don't see those as qualities of one of the 'best' employees. Even if you wanted this job, and even if you were the best engineer in the world, I bet they wouldn't hire you.

    I bet they wouldn't either. It's not in their interest to give short days and time off. That's why they're willing to offer insane money. The only thing you can't buy with money is time, so by paying a lot of money, they're taking huge portions of your only fixed resource.

    However, by doing consulting, I'm able to give companies my time, on my terms, which leaves me time to go SCUBA diving, travel with my wife, go hiking in the woods with the dog and throw parties for friends. That's why I switched to consulting, and I'd never go back.

    What most new programmers don't realize is that no matter what a company offers you for compensation, benefits, etc., it's only there to get you to give up as much of yourself as possible. They're not doing it because they're impressed you can write code or munge their data in some special way. They're doing it because they believe that for whatever they offer, they're going to get more bang-for-the-buck than if they hired someone else.

  3. Re:Everybody can't hire the *best*... on Hiring (Superstar) Programmers · · Score: 1

    The best engineers are going to fall into one of a few categories. Either they are going to want to do something cutting edge, they're going to want a lot of money, or they are going to want public recognition. If the job is sourceforge, it seems to me that only one of those three is a viable option. There are lots of jobs out there right now and lots of new technology. Everybody can't have the best of the best. It's just not possible.

    Or they want to work 4 normal 7 or 8 hour days each week and have a life.

    I can't even begin to explain how much happier I've been since I switched to consulting and have 7 hour days, 3 day weekends and vacations whever I want.

    Life is too short to suck.

    Instead of making $120K/year and having your soul sucked out, you should try making 70K and being happy almost every day.

    Work to live, don't live to work.

  4. Re:I don't get XSS on Cross-Site Scripting Hits Major Sites · · Score: 1

    Actually, CS 101 is data types and algorithms. Earning my CS degree taught me little of input validation. Most programmers learn security in one of two ways: proactively reading up on it or having one of their applications hacked. Unfortunately I think many average programmers don't consider input validation as much of a priority until after a hole they provided is exploited. When I ask many web developers what they do to prevent SQL injection attacks, for example, only about half have even considered it. Scary.

    AFAIK, Input Validation isn't taught in school, but neither are any of the other thousand things a programmer need in order to be a productive employee.

    Things like real-life data conversion techniques between incompatible systems with relationally inconsistant data, building applications using missing and contradictory requirements, knowing when to keep your mouth shut in a meeting, knowing that every problem isn't ideal for your preferred tool, and all the rest.

    FWIW, I'd reject all CS applicants that hadn't already learned a very substantial amount on their own, before ever thinking about college.

  5. Re:Traffic lights on CyberTerrorism - Reality or FUD? · · Score: 1

    We all know the most efficient way to cause chaos over the internet is to control the traffic lights to all turn green at the same time. I can't wait for it to actually happen. Except for a few large cities, Traffic lights are generally too stupid to be controlled in this manner.

    Even if they were, the worst you would have is a few low speed accidents.

  6. Re:Nofollow - useful idea, applied incorrectly on Google, Submission AdSense and NoFollow Letdown · · Score: 1

    What nofollow could have been useful for is a simple "I don't endorse this link" statement so that you can link to sites you dislike without adding to their fame. But applying it to all user-supplied links in blog comments, slashdot threads, wiki pages, etc. diluted its meaning, and as a result, diluted its usefulness.

    But that's exactly what nofollow is for. While you may only want to "nofollow" links for sites you hate, many sites use it for all external links they don't specifically endorse.

    It means that the owner of the site does not endorse the link as being relevant to his site.

    It doesn't mean that the link is crap, it just means that it isn't to be counted for or against the site that contains it.

    For example, I do commercial (retail) sites where they want to put up links to manufacturer's web sites. nofollow lets me do this without diluting the pagerank .

    What's wrong with that?

    Nofollow isn't a "get out of jail free" card, it's just a way to let the SE know that you aren't resposible for the link.

    ---

    SCUBA diving, sushi and yummy pizza, in no particular order: http://www.bupkis.org/

  7. Re:Can someone explain the appeal of (a) fight clu on Techie Fight Clubs Springing Up · · Score: 2, Insightful
    Here's the premise as I understand it: A man find's his work and his life unsatisfying. He is unable to express his individuality and to have the sort of life he wants. His proposed solution: to spend his nights with other losers punching them and trying to hurt them while they try to do the same to him. How is this an improvement? To me it seems far worse.
    It's great for the rest of us.

    When these losers want to "feel something", they beat each other. When I want to "feel something" I go get a massage.

    Want to guess which one of us gets the great job and the raise and which one gets his ass fired for calling sick all the time or coming to work beaten and stupid?
  8. Re:Happened to me on Student Faces Expulsion for Blog Post · · Score: 1

    I was expelled from an Illinois public school for an online speech related issue as well. I set up a web (cgi) based proxy at home, and then informed students at school that it could be used to get around the school filter's censorship of the web. You can read about what happened here: http://www.textfiles.com/uploads/incident.txt

    Congratulations on a valuable experience (notice I didn't say lesson).

    Here's the lesson: When you think you might be in trouble, don't admit to anything. Don't confim that you were "in the media center", that fire is hot, or that you know where the power cord plugs in to the laptop.

    And NEVER sign anything, and NEVER write anything and NEVER admit anything.

    This applies at school, at work and everywhere else. If you're in legal or semi-legal trouble, get a lawyer.

    If someone is trying to bone you, make them prove it. Chances are good that they can't.

    You're extremely lucky that this lesson was in the relative safety of school and not some actual legal trouble. All they can do is kick you out for a while.

  9. Re:Nice Try (NOT!) on UK Hacker loses Extradition Case · · Score: 1

    It may sound silly, but there really isn't a lot of difference between a public unpassworded service and a private service that's been left unpassworded on a public network. It's certainly impossible to tell if it's legitimately public before connecting to it and there's no guarantee you can tell that it's not supposed to be public once you have connected.

    You can't poke a sleeping lion in the ass with a sharp stick, then complain when it attacks you.

    Anybody who thinks that it's OK to go poking around obviously non-public military sites (if you're finding passwords and deployment details, you can be pretty sure it's not supposed to be public) can't be too surprised about being prosecuted.

    In fact, if he wanted to do the right thing, he should have emailed a security contact for the site and notified him/her about the problem.

  10. Re:yes, they do! (NOT!) on Do Kids Still Program? · · Score: 1

    shitty WMM) on an old computer. She then wanted to finish it off and get it encoded and when she hit encode the computer just froze entirely. She said she didn't save at all either (her fault). I had to tell her that she had to do it again and that if she saved it would be okay but then I had to tell her that these computers she was on are not made for video encoding and if they didn't freeze on encoding they would take a year to encode anything at all. She was then all confused because I used the word "encoding" and pissed off. I'll let you in on a secret.

    In 10 years, she'll have a nice job as the production manager at a TV station, and you'll be a pissed-off mid-level geek, who never gets to talk to people outside your department you think that everybody who doesn't code is a moron.

    I've been writing various flavors of code since 1975, from ASM to PL/SQL Java, and found that the real secret is that people just want their stuff to work. They don't care what you wrote it in (or even if you wrote it) or how elegant your algorithm is, as long as they get what they want, when they want it, and the software doesn't confuse, annoy or yell at them.

    The most valuable part of an education is learning how to deal with people.

  11. Not snobbishness, fear of being wrong. on Linux Snobs, The Real Barriers to Entry · · Score: 1

    I don't think the attitude is snobbishness, I think it's fear of being found out to be non-omniscient.

    Due to the infinite variations in combinations of kernel, libraries, packages, configuration files, network configurations and hardware, it's just not possible for the average (or above average) geek to actually cough up the correct answer or procedure for any particular question without actually logging in to the machine to see what's happening.

    This makes the geeks feel insecure and they respond with anger instead of saying "I don't know" or "I can't tell without logging in to your machine".

  12. And This Surprises Who??? on AT&T Forwarding All Internet Traffic to NSA? · · Score: 1

    Is there really anybody who expects privacy when sending information over something called the "public internet"?

    FWIW, I'll never type anything into a computer that that requires secrecy or privacy. After 25 years in software, I can say with great certainty that no matter what precautions are taken, anything stored or transmitted over any medium (digital or not) can surface again at an inconvienient time, either by accident or intent, and generally not due to government interference. Typically unintended information disclosure is from employees (both gruntled and disgruntled) and various flavors of black-hat engineering (social and/or technical).

    I'm much more concerned about things like the huge die-off of the Coral Reefs than the government finding my secret recipe for Pesto Garlic-Pizza.

  13. Re:php? on Point and Click Cracking · · Score: 1

    You're missing the point. It doesn't matter if Amazon runs Linux or DOS or Windows 3.1. Their security is completely irrelevant to me.

    It wouldn't matter if someone cracked Amazon and posted my credit card number on a giant billboard in the middle of Times Square.

    It's completely useless to anybody except the vendor I intended it for, and can't be reused even by that vendor unless I decide it should be.

    A one-time credit card number renders the entire concept of "stealing credit cards" as useless as "stealing random numbers".



  14. Re:php? on Point and Click Cracking · · Score: 1, Interesting

    It wouldn't happen if users logged in with SecureID tokens (or similar), and never used Credit Card numbers from physical credit cards on web sites.

    Want my credit card number? Here is is!

    4264655876823752

    It was only good on Amazon.com, only good for a single purchase and expired after the transaction went through. I don't care if anybody steals it because it's useless as (insert crude useless analogy here).

  15. Re:Will this affect me? on RFID & Viral Vulnerability · · Score: 0

    I'm just curious, will the company also compensate the employees who are working more hours - even if they are coming in late? I know, if you said something like this, they'd call you in and tell you "what a bad attitude you have." or that "you're not a team player." Yeah, I'm bitter....fucking corps...

    Don't be bitter. Life is too short to suck

    Let them do what they want, you do what you can do without making yourself crazy, and if in the end, they don't like it, you can go find a better job, or they can fire you and you can collect unemployment and then get a better job.

    No employer can abuse you any more than you're willing to accept. I got laid of from a crappy job a couple of years ago where I was a "slacker" because I was only working 9am until 9pm, not 8am to midnight like most of the others.

    Best thing that ever happened to me. I got a month of paid vacation in the middle of the summer (unemployment), then got a much better job with normal hours.

  16. Re:Actually... on Comcast Accused of Blocking VoIP · · Score: 0

    Since the outbound data rate for cable is typically only a fraction of the inbound rate, I'd suspect they either don't have the outbound bandwidth available, or are intentionally limiting it.

    Could be crappy service, could be a setup for their own broadband. The only way to tell would be to subscribe to both, and if theirs works and Vonage doesn't it's time to bring in the lawyers.

  17. Re:Welcome to 1982 on Let Joe Average Help You Code · · Score: 0

    It will never happen. The average user has absolutely no clue about the underpinnings of the digital universe, and at this point, it's way too complex to hide.

    As a professional developer, I need in-depth knowlege of at least a eleven (off the top of my head) different technologies and languages just to crank out a small app for a medium sized business.

    For example, a small web-based app would require knowlege of:

    HTML
    CSS
    Javascript
    Browser Incompatibilities
    Database Connectivity
    The Database Schema
    SQL for the DB Flavor of the Day
    Network Authentication
    DB Authentication
    Web Server Security and Configuration
    ASP/JSP

    Although end users have been cranking out apps since computers have existed, they've also been painting themselves into corners for that long.

    Making software design "easy" just gives the users better tools to eaily write the wrong software that doesn't do what they want.

  18. Re:Decentralize on Razorback2 Servers Seized · · Score: 0

    But hey, give away all the music you want to. Encourage the people you give it to, to do the same. When they stop producing the kind of music you like because it's not profitable and yet another fake blonde with surgically enhanced curves tops the charts with soulless, mindless music cut straight from a corporate "one hit wonder" template, you'd better not complain. If you don't want people buying good music, don't expect artists and labels to invest what it takes to get it to you.

    Can you imagine if individuals and small groups of local musicians got together and played because they like to, not because they were getting paid millions of dollars?

    They could play after work in parks and coffee shops, and put their music up on the web for people to share for free. Maybe they could even get warm fuzzy feelings for making music people like.

    They would do it because they enjoy it, not because they're getting paid, just like musicians have done since the first humans beat clubs on the ground in rhythm.

    Doesn't that sound horrible? No big record companies, no "Digital Rights Management", you could find music you like and play it on your MP3 player or tin can and a string if it made you happy.

    As an added benefit, I suspect that without marketing, the number of artists producing recordings that glorify death, violence or sound like 1000 cats being strangled by noisy robots would be reduced quite a bit. Much of it wouldn't get more than a first play.

    What a shame.

    Not. If they need money, they could get real jobs just like the rest of us.

  19. Re:To be blunt... on What Do You Want in a Job Website? · · Score: 0

    When I search for jobs near me, I want a site that only lists jobs near me I do not want "Nation-Wide Job Opportunities"

    I live in NY State, not New York City, and it makes me insane when I get a call from a recruiter in North Carolina trying to place me in a job in Manhatten

    "Sure I can take the job! Will your helicopter be picking me up in front of my house every day?"

    "Leave my wife for 6 months to be a code monkey in a nameless cubicle in a strange city where living expenses will bring my wages down to the Wal-Mart level? Sure! Why not!"

    I want a site that returns results that match my skills in the geographic area where I want to work. It's not rocket science.

  20. Re:Unfortunately... on Advanced Requests and Responses in Ajax · · Score: 0

    Except that c) doubles the costs (at least) the company will incur. While it is the right answer from a technical standpoint, from a business standpoint it isn't optimal.

    Doubles the cost of what?

    If an engineer costs $150K/year (including bennies) and a CS geek costs the same, the impact on profits for anything that would actually require that level of geekiness would be minimal.

    If you take into account support costs and potential failures for having crappy code in an embedded system, the costs is truly insignificant.

    How would you like to pay for a recall of 100,000 television sets because it would crash if you cycled though the channels then hit "volume up"? How about recalling thousands of SCUBA diving computers because there were certain combinations of conditions that would cause it to lock up while in use (under water) - actually happened. How does the cost of an extra engineer compare to the cost of a wronful death lawsuit?

  21. Re:Mindboggling, indeed on Underwater Ocean Currents Used to Power Bermuda · · Score: 0

    Just how many current-surfing turtles and fish can we expect to be missing from Finding Nemo 2 because they get swept into the four turbines?

    It's no more possible to get sucked into water-powered turbine than it is to have your shoes drag you off the sidewalk and out into traffic.

    The turbines, by definition slow the water down.

  22. Re:Harbinger of bad news? on Government Cyber Storm Ends · · Score: 0

    world knows of virus and malware programs is only what has been discovered AND disclosed to the public. It is quite probable that there are malicious programs out there that are stealthily eating away at personal and business data or waiting till the right moment to do so, or worse, transmitting small bits and pieces of it back to the 'boss' on a regular basis.

    They're called "employees", and have been intentionally and accidentally destroying data since before the dawn of computers.

    There's very little difference between protecting against an "attack of malice" and an "attack of stupidity".

    Some of the worst damage I've seen was caused by a data-center manager testing the UPS and Generator systems, when the test failed.

    You've never heard quiet like the quiet from a data center when someone hits the "Big Switch" and the UPS batteries are 5 years past their replace date, and the generator doesn't come online. The sound of a 1000 servers not running is memorable.

  23. Re:From TFA on RFID Injection Required for Datacenter Access · · Score: 1, Interesting

    I suppose the official reason for termination would be "uncooperative attitude." Certainly not "he refused to get chipped." Or maybe the company will concentrate on ways to make the employee so miserable, he just quits. Problem solved.

    When I was young and dumb, I was forced out of a job in exactly that way (made me so miserable, I quit). It turns out that's very common in some companies and keeps their unemployment insurance rates low.

    Later on, I learned that it was also illegal (at least here), although by that time I had lost interest in doing anything about it.

    I would also expect that being microchipped would have the Chritians up in arms over "The Mark of the Beast" (can't blame them on this one), and Jews (and possibly others) have a prohibition on body modification.

    I'm pretty much astonsished that anybody would actually require this, and given the bizzareness of the requirement, would be more likely to suspect that this is a troll

  24. Wow! Talk about "Vendor Lock-In"! on RFID Injection Required for Datacenter Access · · Score: 1

    Can you imagine trying to tell the employees

    "We've got Good News and Bad News. The Bad news is that we got 10% off from another vendor if we agree to switch to their new iris verifier. The good news is that we're going to cover 50% of the cost of having a surgeon remove the old implant, and that very few of you will have permanent damage"

    Unless they're paying a fortune (maybe 10x-20x the going rate) for salaries, I can't imagine any self-respecting geek allowing personal hardware modification (chip implant) at the request of an employer. Personally, I'd tell them to talk to my lawyer, and if that cost me data-center access or my job, I'd tell them to talk to my lawyer again.

    Some religions prohibit body-modifications so it should make a facinating test case.

  25. So what's the problem (or the purpose?) on Limited Email Surveillance Approved · · Score: -1

    This probably won't be a popular opinion, but I don't see any problem with them monitoring to: and from: addresses.

    Given the availability of "throw-away" email addresses, I also don't see much use for it.

    Sounds like another decision made by committee.