Slashdot Mirror


User: SillyNickName4me

SillyNickName4me's activity in the archive.

Stories
0
Comments
3,216
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 3,216

  1. Re:You don't even need the source code on Keeping Passwords Embedded In Code Secure? · · Score: 1

    Do you have source code to all your hardware's firmware and the complete schematic's to its design ?

    For the bios we have the source code, yes. Complete hardware schematics not of everything to the detail that we would want, but enough to verify its workings. With regards to hardware the requirement is slightly different however, having the schematics is only a small part of the picture, being allowed to verify that machines are produced in a secure environment and according to the published specs is at least as important there, it is way too easy to hide something that wont be obvious from just verifying the design.

  2. Re:USB to the rescue! on Managing Mail Between a Desktop and a Laptop? · · Score: 1

    It's all about the actual specs of the parts in use. If you don't buy the right product for the job, you can't expect it to do the job. Maybe you've been buying cheap knock-offs -- stuff without wear-leveling, or with only 10K rewrites or some other deficiency. No way I can diagnose your problems without the actual specs of the actual parts and the actual usage they've been subjected to.

    Well, I am not asking you to diagnose my problem, was more pointing at something that we found, and that if you search google a bit, is something we are not entirely alone in either.

    One of the brands we tried is sandisk, don't remember the others.

    Try samsung and maybe PQI. My clients use M-systems which sounds like it is beyond your budget.

    Thanks, will at least check if we tried those also.

    Either way, if you are constantly paging, you should just buy more real RAM. Nowadays, swap should only ever be used as a last resort.

    Sadly enough, that is not how Windows works, it copies any executable code to the pagefile, and then pages into memory what it needs, so as long as you have a pagefile at all, it will be intensively used if you start different programs often.
    Linux is a slightly different story, but it writes to the pagefile way before actually needing it as well, tho with the difference that you can tune how aggressively it does that.

    So no, more ram is in itself not going to prevent this. Disabling swapping alltogether is an option if we could guarantee that everything always fits into memory.

  3. Re:USB to the rescue! on Managing Mail Between a Desktop and a Laptop? · · Score: 1

    We started with 20 small machines with 4gb "flash drives". What type you ask? a variety of flash drives as available to consumers. That means various brands, and most likely various different manufacutors. Most of those were producing write errors after 2 months of use. Use here means indeed virtually constant reading and writing.

    You see, it is nice what is theoretically possible, but as long as that is not what is typically available then the argument remains a theoretical one with no value for practical purposes.

    How about you informing us where we can buy flash drives that will indeed last as well as you claim? We could try them in a real world application and see if they will work, provided they are not insanely priced.

  4. Re:USB to the rescue! on Managing Mail Between a Desktop and a Laptop? · · Score: 1

    Sure, theoretically all nice, but real world testing really gives a different picture. As I replied to your sibbling post also, a 4GB flash drive should, according to your calculations, last for at least 8 months when used for storing a pagefile. I have tried this on quite a few devices, and for such use, a flash drive typically fails after some 2 months of constant use. This gets a lot worse still when also using the flash for other things (which limits the number of cells available for writing)

    I have been using quite a few flash disks in so called thin clients, exactly because of their supposed reliability and quietness due to not having moving parts. It has proven itself unworkable for this as soon as we put a pagefile on there, while it turns out quite well as long as we don't.

    And indeed, price/GB is just another issue wich can make flash an unattractive alternative for such use.

    That doesnt change the advantages it has of course.

  5. Re:USB to the rescue! on Managing Mail Between a Desktop and a Laptop? · · Score: 1

    So tell me, why does in a real world test, a 4GB flash drive that claims to support over 100k writes die within 2 months of usage as storage for a pagefile? According to the claims made, it should last for at least 8 months, but it consstantly does not.

    Not to mention that a 140G flash drive costs quite a bit more then a high-end 140G scsi disk, so it is an extremely expensive route to go even if it would do what you claim.

  6. Re:USB to the rescue! on Managing Mail Between a Desktop and a Laptop? · · Score: 1

    that's 474 days of constant writing it can handle.

    which isn't anywhere near the approx 5 years a decent 'enterprice' disk lasts under very heavy load.

    Not to mention that changing a few bytes in a sector still results in rewriting the entire sector (in both cases), so with the given bandwidth, you can end up with a lot more writes then you assume.

  7. Re:You don't even need the source code on Keeping Passwords Embedded In Code Secure? · · Score: 1

    What has changed is that computers are much networked than they were back then, so remote access would almost certainly be expected, even _IF_ it wasn't explicitly a design requirement. As a result, we would not be able to make any assumption that arbitrary people might not be able to make attempts at breaking the software.

    Well, I understand your assumption here, but a substantial part, if not the majority of all security breaches are inside jobs, and not some random network based hacker. You sure you also trust the people who for example do building maintenance and cleaning for example?

    I'm sorry, but while understandable, your assumption back then was really not correct.

  8. Re:You don't even need the source code on Keeping Passwords Embedded In Code Secure? · · Score: 1

    Like I said before though, it's not a mechanism I would use today.

    I got that part, but the issue here is this:

    As I mentioned before, in itself, there are valid reasons to have a backdoor, and as you described the one incident where you made use of it, it doesn't sound like your use of it was invalid at all.

    The issue is that by implementing it, and by not informing your customer about it, you exposed them to a security problem that they could not judge, and that is what I take issue with.

    Today your use of a backdoor would be as valid, and the exposure for your customer would be the same. So all that seems tohave changed is your knowledge and understanding of the risk such a setup poses.

  9. Re:USB to the rescue! on Managing Mail Between a Desktop and a Laptop? · · Score: 1

    In a lot of cases, flash memory will last longer than an equivalent spinning disk would under the same conditions.

    Mostly flash doesnt get damaged really from being under power but idle, disks do.

    On the other side, put a page file on a flash device and see how quickly you can destroy it.. :)

  10. Re:You don't even need the source code on Keeping Passwords Embedded In Code Secure? · · Score: 1

    The danger of it ever having become publicly known that there was a backdoor was negligible... the number of companies that we wrote software for was countable on one hand, and being vertical market software, there was no danger of it being used elsewhere.

    Well, you just made it public..

  11. Re:You don't even need the source code on Keeping Passwords Embedded In Code Secure? · · Score: 1

    So essentially you're saying that your job is to recommend against closed-source software. That's great.

    No it is not. Giving my company access to the source code can be based on a NDA, and in no way requires you to produce open source software.
    WE want to be able to verify that no backdoor exists. Alternatively, we could arrange a guarantee by means of a contract that no such thing exists with a very hefty penalty attached if it turns out otherwise.

    That is not, however, what this guy is talking about at all. If his customers required access to the source, they would have made that apparent in the software requirements specification, and the guy would have priced it accordingly or submitted a no-bid.

    It is people like him who actually substantiate our demand to be able to verify that no such backdoors exist, instead of accepting a statement to that extent.

    Really, this entire discussion is stupid. "If I don't have the source, I assume a backdoor" "Yeah, so?" "Well your software would never be allowed in my company." "Ok, I don't remember ever selling it to you, or having a quote request come from you." "Yeah, because I'd never allow your software in my company

    If you believe it is stupid to point out bad and potentially very harmfull practises...

    I guess I have some good reason now to not care much about your opinion on those matters.

  12. Re:Monopoly? on Keeping Passwords Embedded In Code Secure? · · Score: 1

    So what do you do when you suspect a backdoor in the software published by a monopoly or by each member of an oligopoly? Do you put your business on hold for 20 years waiting for the patent to run out?

    Pay someone to write an alternative, and live in a place where software patents are not valid to begin with. And yes, we did the first, and yes, I am living in a place where software patents are not valid.

    On top of that, making sure 3rd parties do not get access to data about our customers is actually a legal requirement we have under EU law, so as an alternative to giving us access to the source, you could of course give a guarantee by contract that no such backdoor exists.That will be looked at on a case by case basis.

    The number of incidents caused by disgrunted former employees from software development companies is a bit too high to not take the existance of backdoors serious.

  13. Re:You don't even need the source code on Keeping Passwords Embedded In Code Secure? · · Score: 1

    So you're really going to spend tens of thousands of dollars to recover non-existant damages to prove a point? The conversation might go something like this:

    Since the company I am working for, and for which I am responsible for security, works a lot with sensitive information from customers, the risk of losing their trust is quite there, even more so if it becomes publicly known that such a backdoor existed. In that case there wold be real damage even if no actual security breach ever took place.

  14. Re:You don't even need the source code on Keeping Passwords Embedded In Code Secure? · · Score: 1

    I mean, so what if you suspect a backdoor being there, what do you do about it? Not use the software?

    Generally spoken, that is indeed the correct answer.

    This wasn't an option for the companies who contracted us to write the software for them...

    Sure it was, they could have contracted someone else who gave them the possibility to review the source code.

    and no, we didn't tell them about the backdoor. Neither, however, did we ever actually use it except the one time in the 12 years that the software was being used that it was necessary to restore working functionality to an otherwise inoperative system due to damaged data files.

    Sure, and that is a valid use of a 'backdoor'. It also means that you caused an extra security risk for your customer. Giving them a choice beforehand instead of telling them a decade after the fact would have given them a choice, which they did not have now.

    With all respect, I don't doubt your intentions, but anyone who ever pulls such a thing on the company I am responsible for cancount on:
    1. never ever getting me as a customer again
    2. meeting me in court

    As I said, I can't imagine I'd do it this way if I were to write an application for anyone today, but I am saying that this mechanism has worked in the past, and it has worked very well.

  15. Re:You don't even need the source code on Keeping Passwords Embedded In Code Secure? · · Score: 1

    and as nobody else would have ever had reason to suspect that there was such a backdoor in the first place (we never told anyone until long after the software fell into disuse, and even then it wasn't deemed a security risk by anybody because phsyical access to the computer was necessary to enter the password anyways)

    Excuse me?

    Whenever I get apiece of software of which I cannot verify the source, I suspect a backdoor password being there. This is basic security and has been documented at least since the first edition of the DOD orange book on secure computing systems. Anyone who claims to know about security but does not assume this, is ignoring at least 3 decades of best practises with regards to security.

    Of course in an environment where security doesn't matter, this is not a concern.

  16. Re:how about google on Vista vs. Cairo - A Microsoft History Lesson · · Score: 1

    When I go buy a coffee in many of the places around, I get some bit of coffee creamer with it, regardless of if I ask for it. If I explicitly tell them waiter to not include it, it usually (but not always) won't be there.

    That said, none of those places insist on putting the creamer in the coffee for you and stirring it (usually they will do so when asked however)

    The problem with Microsoft is that they keep insisting on doing something similar to putting in the milk and stirring.

    Not a big problem for me personally, I just don't use their products. It is a big and costly problem when looking at it with a bit more of a bird's eye view however.

  17. Re:Asshats on Russia Agrees To Shut Down AllOfMP3.com · · Score: 1

    that's amazing. I grew up in a area that was far below the US average income. in fact, we did actually car pool growing up and most of us ran cars on just a few bucks of gas to spare money for other things. but my god, we still went out to eat, rented movies, went to movie theaters......

    Below average in no way imlies being part of the lowest 10% which to the standards of the USA live below the poverty line which means they do not have enough income to pay for proper housing, food and clothing.

    but there was this amazing thing that most of us had to supply us the disposable income to go out to dinner(even if going out to dinner meant DQ), we called it a part time job and yes, they are out there even if they aren't fun or rewarding. Now I think you are making a big leap from what I was saying, so I'll say it again.

    I have no idea about the sister of OP, but I definitely know that kids below 14 or 15 have very little to no chance on such a disposable income, or any income in fact. Yes, there are exceptions but it is not the rule.

    The parent didn't say his sister was destitute, he was trying to make the point that she bought music when it it fell in line with her preferences ( and implied as soon as she had the money, she bought the music so in fact, she didn't cause a negative impact). my point was simple, if she does have disposable income to do other things, then its just a choice and suddenly, there is a negative impact because the ability to download distorts those choices.

    And you are making assumtions about things that hae clearly not been said, and where the opposite of your assumption was implied, learn to read and stop assuming.

    I was a teenager once without the most full of pockets. I made my choices on how to spend the money I had and it wasn't ever all on one item. if I had the chance of getting something small for free to free up money elsewhere, I took it. I"m not saying its not commonly done.

    If you dont want to discuss the things being stated, but rather want to tell about your time as ateenager that is fine, but you are not the average person obviously.

    If you want to get a clue, look at how people are doing on average, not how the more positive cases are. The later say what is possible, but not what is reasonable.

    oh wait, you wanted me to take the OP literally when he said his sister was saving pennies to buy music. look up the word hyperbole. its extremely pertinent to the OP.

    Maybe you should read the OPs reply instead of assuming things.

    Oh wait, reading and actually basing a discussion on what is being said instead of your own assumptions is too difficult for you (and if you disagree, then start showign you can discuss what is being said)

  18. Re:Asshats on Russia Agrees To Shut Down AllOfMP3.com · · Score: 1

    so in other words you are trying to actually say this poor poor girl has no other money (besides what goes to necessities like food, water, housing, medical care) and whose only discretionary purchase she ever makes is music?


    If you cant be bothered to actually read the thread you are replying to, then maybe you should also simply not reply..

    Not to mention you are really mistaken. Looking at the USA alone, some 10% or more of the population does indeed not have the disposable income you are talking about. Most teenagers also have school and such and dnt have the knd of disposable income you are talking about.

  19. Re:Different kinds of innovation on Is Microsoft An Innovator? - The Winer-Scoble Debate · · Score: 1

    Consoles didn't have seamless integrated online functionality before Xbox Live. Sony and Nintendo are playing catchup now.

    That is innovation.


    And consoles have been playing catchup to PC based gaming in this for a long time.

    Applying an existing idea from one environment in another very closely related environment seldom involves innovation at all.

  20. Re:Out of proportion on Is Microsoft An Innovator? - The Winer-Scoble Debate · · Score: 1

    You will see people claim it's just a ripoff of a technique used on the Apple II, but that's like saying that the automobile is just a ripoff of horse-drawn wagons. It's a genuinely innovative improvement of a technology that everyone thought had been obsoleted by multi-colour high-resolution monitors, until Microsoft invented a way of using it on modern computers.

    The powersource was innovative, making it to fit in a car involved some innovations most likely, but exchanging one powersource for another better powersoure is in itself not innovative.

    Aplying a new technology to an existing apperatus can involve innovation, but is not innovation in itself. Applying an existing technology to a new situation may again involve innovation, but is not automaticallz innovation itself.

  21. Re:Out of proportion on Is Microsoft An Innovator? - The Winer-Scoble Debate · · Score: 1

    If that isn't innovation, what the fuck is?

    Applying an existing idea maybe?

    Usefullness does not equal innovation.

  22. Re:Yeah for the raccoons on Supreme Court to Rule On 'Obvious' Patents · · Score: 2, Insightful

    I agree that the motivation portion of the test is valid. If there has been a problem, with repeated failed attempts at a solution, over the course of years, then the solution is not obvious, no matter how simple it is in practice. (Encasing batteries in a metal housing to prevent leakage is the example given in the transcript - a 20 year problem with a stupidly simple solution.)

    The motivation part is important, sure. However, saying that if people have been looking for a solution for decades, and only now someone 'found' a solution is not a good test because it does not account for the often occring sytuation where not all technology required exists untill now. The underlying technology might be a candidate for a patent of course, thereby inspiring others to come up with an alternative.

    With the battery example, a metal cover should not be patentable, but a specific way to make that etal covering might well be patentable.

    The "teach, suggest" part of the test is just a restatement of prior art. "If the body of prior art teaches or suggests a solution, it is obvious, otherwise it is not." Transferring the "genre, artist, album, song" hierachy menus from a computer's jukebox program, to an MP3 player that has a graphical display fails this test for anyone reasonably skilled in the art of interface design, and yet the patent was granted to MS.

    Hence my statement that people arguing that obviousness equals prior art + documented motivation to combine that prior art, are acting as if those who wrote the law are a bunch of idiots who did not realize they wrote the same thing twice. That this line of thought is invalid should really be obvious.

    How do you fix it so that solutions that are "obvious to someone reasonably skilled in the art" can be shown to be obvious to people not skilled in the art? I have no ideas. I just know the current method doesn't work.

    The problem is that you can't in many cases. Someone not skilled in the art does often not have the experience to understand how the solution is obvious.

    If you want patents and don't want a 'first to file regardless of inventiveness' situation, you HAVE to use experts to determine the validity of said patents, and judges are not those experts, they are experts in entirely other things, and there are very good reasons why we leave certain kinds of decisions to them, but techical validity of a patent should not be one of them.

  23. Re:Yeah for the raccoons on Supreme Court to Rule On 'Obvious' Patents · · Score: 1

    while protecting against "real" obviousness (where all of the pieces were clearly known to those in the art, just nobody had yet bothered to write an article on or patent the combination).

    Te problem is that this is not what 'real' obviousness is, rather, this is called prior art, which is handled seperatelz in patent requirements.

    Obvious is a solution that a person skilled in the art would likely come up with when confornted with the problem, regardless of if that solution was known beforehand.

    (amd yes, I am aware that that is not how it is treated right now, but there is some obvious duplication of requirements going on as a result, and really, those who wrote current patent law at the time were smart enough to not put duplicates of the same requirement in there, so it is extremely unlikely that the current obvious test is what was intended by patent law)

  24. Re:Yeah for the raccoons on Supreme Court to Rule On 'Obvious' Patents · · Score: 1

    How do you propose to perform your test? If others "skilled in the art" already know that there is a solution, then you are injecting hindsight into the equation, and EVERYTHING is obvious once you have hindsight.

    You are wrong first of all because knowing that a solution exists does not mean knowing what the solution is. Patents are about how you solve it, and not merely a statement that you solved it.

    Actual knowledge of the workings of the solution would introduce the problem you mention of course.

    The purpose of patents, as is oft repeated, is to advance the useful arts (whether it does a good job or not is not really the point here, though!).

    Wether it does a good job might not be the point, but is extremely relevant for the discussion. If patents do an extremely good job then paying a higher price for them by society (in the form of more patents being granted) may well be acceptable. If patents do an extremely bad job then we can skip the entire discussion and do away with them.

    A patent, for better or worse, at least makes public the invention, so others can see it, benefit from it, and build upon it -- maybe not immediately, but eventually.

    With the current rate of technological development, there is a good chance that the invention will be irrelevant way before the patent expires.

    If you don't bother to tell anyone about your inventions, or don't bother to publish papers or put up a webpage or whatever, then the public is not benefiting from your invention,

    If they can buy the resulting product they may very well benefit from it.

    so you are not entitled to a patent (under current law). Someone else who comes up with the idea, dilligently works to develop it, and then gives the knowledge up to the public IS entitled to a patent.

    All nice and well, but your product wont sell without making it known, and what is more, in many cases selling your product gives others a relativelz easy way to figure out how your invention works

  25. Re:Yeah for the raccoons on Supreme Court to Rule On 'Obvious' Patents · · Score: 1

    I didn't even have non-portable email in 1991. So from that perspective, it was not at all obvious. On the other hand, it was also something for which a concrete implementation was not technologically feasible at the time.

    Unavailable at the time is really not the same as non-obvious. The second part of your statement esplains why it was not available quite well.

    But the patent isn't on the idea of doing email wirelessly anyway. It's on what amounts to UUCP, except sending data to a wireless email reader instead of sending it by telephoning some other computer in another state. It's a patent on a design that in similar (but not identical) applications had been in common use since the 70s (at least). Indeed, the RIM patent gives new meaning to the word obvious once you dig beneath the superficial red herring question of whether wireless email was obvious in 1991....

    It did not have to be identical anyway because unlike what the courts seem to have thought so far, prior art and obviousness are at times related, but are not the same thing, and one does not require the other at all.

    The problem is the 'obviousness' standard as it is currently being used, wich comes down to "A combination of prior art with a prior documented motivation to combine the prior art".

    Obviously that is rubbish, prior art is covered seperately in the requirements for a patent, and not treating obviousness as something differet then what is currently the norm is showing some very serious disrespect for those who wrote current patent law. The people who wrote it were really not as stupid as to mention the same requirement twice.