Slashdot Mirror


User: grcumb

grcumb's activity in the archive.

Stories
0
Comments
2,253
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 2,253

  1. Re:A good start to the discussion on Foundations of Mac OS X Leopard Security · · Score: 3, Insightful

    OSX has fewer security holes than Windows. How can you say that with any certaintity when you don't have the worlds underground hammering at your door every day for years on years? I believe the mac is simply a less valuable target to those to seek to circumvent your computers security. If the rewards were there, the security problems would be too.

    Others have already replied about Apple's intrinsically superior security based on its BSD roots and more sensible user permissions. There's no need to go into that agaiin.

    But there's an additional by-product that good design gets you: If people believe that cracking your system is harder, they won't be as inclined to try.

    Case in point: All Debian-based SSL encryption was fundamentally broken for over a year, and yet (as far as we know) it didn't occur to sysadmins and developers to actually test the security of their certs etc. More interestingly, it doesn't seem to have occurred to crackers to even probe Debian's SSL implementation for vulnerabilities.

    I wrote a quick run-down on this phenomenon (with a few caveats) on my website. In hindsight, it's nothing short of astounding that nobody caught this error. Considering that the payoff for a computer criminal would be potentially huge, I can only attribute the failure to comprehensively exploit the vulnerability to a folk-wisdom phenomenon, which is that if your software is generally considered safer, rightly or wrongly, people will tend to treat it as if it were, and leave it alone.

    The converse, of course, is that if your software (e.g. Windows) is generally considered insecure, people will go to great lengths to exploit it. When you look at the cleverness of some of the hacks used to infiltrate a Windows system and compare the level of knowledge and skill required to simply brute-forcing Debian's broken SSL, you'll see what I mean.

  2. Re:Cellphones as "enablers" on Nokia's Cellphone Anthropologist · · Score: 4, Insightful

    There is a simple reason for it. If they were to introduce a simple and robust phone, people in developed countries would cry out for it, and their overpriced complex phones with features that will never get used will not sell anymore.

    That's untrue, at least in my experience.

    The incumbent monopoly in the developing country where I live never showed any interest in selling glitzy phones. In fact, the phones they offered were cheaper, more robust and simpler than what you could get just down the road.

    Just this year, the telecoms monopoly has been terminated and the latest entrant is even more intent on offering phones that are well-suited to this tropical environment. When they set up shop in nearby Papua New Guinea, they were offering two pre-paid phones for the equivalent of about USD 15.

    Telcos in the developing world know which side their bread is buttered on. They provide a service, not a product. With the introduction of competition here, the two telcos are fighting for mindspace based on coverage, call quality and price. Selling reliable phones - even packaging them with solar charging kits - is the only way they can ensure a reliable revenue stream.

  3. Re:Cellphones as "enablers" on Nokia's Cellphone Anthropologist · · Score: 1

    Hopefully we'll see more companies designing different products for different economic realities, instead of just dumping 5-year old designs here once they get "cheap enough for the third world".

    In my little corner of the Developing World, this is exactly what's happening. The local telecoms monopoly has just been ended, and the newest entrant has offered up a cash bond to deliver mobile telephony services to 85% of the population in a country with incredibly difficult geographical features.

    Obviously, they wouldn't do so if they weren't convinced that they can make money in these marginal areas. In order to do so, they need to tailor their products to local needs.

    I write a weekly IT column in one of our national newspapers. Here's what I had to say about SMS as a computing platform. And here's one where I make the case for focusing on mobile communications technology.

    In confess that it took me a long time to stop being a bit of an Internet bigot, refusing to see the potential applications of mobile phone technology. I've since changed my ways.

  4. Re:Privacy isn't that difficult. on Understanding Privacy · · Score: 1

    Here is my essay on privacy; see if reading it doesn't nail the issue for you in very short order.

    Nicely put. But let's play duelling essays. This is a layman's introduction to understanding the nature of online privacy, written for my weekly Communications column in the Vanuatu Independent newspaper.

    To summarise: You're dead right on your definition of privacy. Most everyone is at least innately aware of this. While technology has transformed our ability to access information, nothing about the nature of privacy has changed. Unfortunately, that doesn't resolve the problem that people often can't visualise the public and private sphere where computer data is concerned.

    Put most simply, I would certainly take exception to someone reading my private email without permission, but I'd have to know they were doing it first. It's not even enough to know that 'Goverment X is reading everyone's email.' People need to see that Person X has read their email in order to trigger that sense of impropriety that is natural to us if the snooper is in the same room.

    The Internet empowers the observer precisely because the observed almost certainly won't know they're being watched. This apppeals to a part of human nature that exists in all of us: If we could get away with it, we would invade others' privacy all the time.

    Gossip, rumour-mongering and prurient spying are innate human instincts - and precisely why the social conventions on privacy arose. Social awareness and taboos need to be adjusted to the fact that the snoopy ones are no longer in the same room with us.

  5. Re:Nothing new here... move along... on Nuclear Warhead Blueprints On Smugglers' Computers · · Score: 1

    A first-year physics student called John Aristotle Philips did all this as a summer project his first year at Princeton, way back in the early 19790s.

    Feh, of course it would be easy for him - he's already mastered time travel!

  6. Re:Don't get me wrong... on Why OLPC Struggles Against Educators, Big Business · · Score: 1

    I know that asking such questions often makes one a pariah in the eyes of narcissists more interested in self-gratification than actually helping people who need it. But when are people going to realize that sending money or goods to countries ruled by corrupt governments only benefits the corrupt governments?

    You're right that such questions often do make one a pariah. But the question: who, exactly are these narcisisists? In my experience (I've been working for the nearly 5 years now in a Least Developed Country), the self-congratulatory narcissists are the donors themselves.

    There most assuredly is a great deal of corruption among governments of developing countries. Quite often this suits donors' political objectives just fine. They find someone amenable to their way of seeing things and prop them up without any regard to the cost to the common people.

    The biggest task of development is often just to keep the bad things from happening. It's a game of snakes and ladders at the best of times, but as often as not, the snakes are not the local kind.

    I like the OLPC project, because it makes a few simple rules and it sells a thing, rather than a service. Compare that to the efforts of a certain international donor who recently did the rounds trying to drum up interest in a telecentre project, which was projected to cost USD 250,000 for 2 telecentres. When I publicly expressed amazement at the cost, the only reply I got were two off-line responses that the bulk of the money would go to foreign consultants, who bill about USD 800 per day.

    OLPC is not perfect, not by any stretch of the imagination. But compared to what else is out there, it's the best answer I've seen to the question of improving communications and education at the village level.

  7. Re:Media player. on nVidia Preview 'Tegra' MID Platform · · Score: 1

    And special this month I'll throw in an ethernet cable impedance tester to tell you when you need to replace your cables due to oxidation.

    Will that work with nuclear as well as hydro-powered oxidation? I've heard that oxidation from nuclear power is much drier than hydro power, so rust doesn't form as easily, but oxidation happens twice as fast.

    Also, is there a website, or maybe a newsletter somewhere, that will tell me what kind of power I get at home? My address is: 513 Maple St.

    Thanks!

  8. Re:Simple recipe on What Could You Do With a Bogus Root Name Server? · · Score: 2, Informative

    Which email client brigns up an error message for a self-signed POP3 server certificate?

    Mail.app and Thunderbird, for two.

    Mail's error message actually characterises a self-signed cert with language to the effect of, "Couldn't connect to the server because of an untrustworthy certificate." When this was reported to me by a non-technical user, they repeated only the first two words: Couldn't connect.

    That's how things should be.

    I'm hoping that Firefox's improved handling of self-signed certificates gets copied over into Thunderbird's UI as well.

  9. Re:How is the mechanism exploited? on New 'Phlashing' Attack Sabotages Hardware · · Score: 1

    Is it possible to exploit firmware from the outside, unless the person has enabled remote management and is using the default password?

    The latest research seems to indicate that it is indeed possible to exploit weaknesses in network card firmware - or any card on the PCI bus - to traverse firewalls.

  10. Re:why sare? on Folders vs. Tags For Shared Email Accounts? · · Score: 1

    Why don't you just send a copy of every email sent to that address to each of the 10 members individuals addresses, and let each of them sort it anyway they want.
    That only works well under the presumption that everyone's able/bothered to work out their own filtering system... and that's one heck of a presumption :)

    Correction: That only works well if you accept that people are capable of being moderately competent at their job.

    This is a textbook example of someone trying to use a technical answer to replace (not improve) a human process. Unless the members of the group are going to actively use a consistent and mutually comprehensible process, no amount of tagging or arbitrary organisational measures is going to work. And in any group of 5 or more people, that's a lot to ask.

    The solution: Set a few basic expectations about job performance, make sure they're enforced, and let people achieve those expectations in the way that suits them best.

    Mailing lists or mail forwarding to individual accounts works just fine. If that doesn't have a satisfactory result, then you've got other fish to fry. No amount of technology will make people cooperate if they're not already inclined to do so.

  11. Re:Anyone else on Unix Group Takes UK Standards Body To Court Over OOXML · · Score: 1

    Not really give a shit about OOXML? I mean just reading the wikipedia page makes me sleepy. Countries are actually arguing over this? This has to be last on my list of things that need sorted out.

    That's nice, dear. Why don't you go look at some nice kittens?

    Now if you don't mind, those of us who do give a shit would like to discuss this latest development.

  12. Re:I have new respect for the NYTimes on NYTimes.com Hand-Codes HTML & CSS · · Score: 1

    My dad likes [programming IDEs], my mom regards them as the bane of true programmers everywhere. What does /. think?

    To the extent that Linux itself can be considered an IDE, I love them. 8^)

    No, seriously: The beauty of Linux is that you have everything you need for any imaginable coding scenario right there at your fingertips, all the time.

    As far as editors are concerned, I use vim and emacs in roughly equal proportions, depending on the task.

  13. Re:This may be a good thing in the long run on MS Beta Software To Manage Unix/Linux Systems · · Score: 1

    ...USB powered urinals....

    Man you give a whole new meaning to the phrase 'hot plug'.

  14. Re:As a wild guess... on 80% of MS Server Protocols Are Unpatented · · Score: 3, Funny

    It's a little like licensing a sewer system in which nothing is patented except the toilets. That last 20% makes all the difference in the world.

    I don't know where you live, but in my world the toilets are the first 20% of the sewer system, not the last. I really wouldn't want to have it any other way.

  15. Re:Were you grown in a vat? on Widespread Keyboard Failures on OLPC's XO-1 · · Score: 4, Insightful

    If a kid has no real concept of value anyway, what on earth would motivate him to be more careful than with anything else they are used to playing with?

    I don't want to be seen to be defending your snarky reply, but it's relevant to note that the issue of caring for the XO laptop is a real one.

    It is not, however, because of children's inability to see the value of such a device. I work in development, and I've tested the XO. I've also written about it a fair bit. The big challenge for children using this device will be the lack of ready infrastructure in the village.

    When you have to walk several miles to school in the rain with nothing more than a banana or a taro leaf to cover you, the XO is vulnerable. When you have to wade across one or more small rivers on your way to school, the XO is vulnerable. When you live in a house with dirt floors, the XO is vulnerable. When you have to contend with the fact that your many siblings might well want to share the laptop, the XO is vulnerable.

    BUT... I've tested a late prototype and seen for myself that, whatever its faults, there is nothing else available that even begins to approach the XO for robust construction. Try to imagine any other computing device surviving what I've described above. The XO laptop is the best available technology today, and that's why we'll shortly be deploying our first pilot project.

  16. Re:Duh - we all do. on Who Pays for Rebuilding the Internet? · · Score: 1

    I think your proposal would save lots and lots of bandwidth. That's great. But I think ximenes' point is that it would bring in a culture of scarcity to bandwidth usage....

    But that's exactly the point. The Internet is anathema to the old Telco business models, so they want to change it back into the kind of network they're used to running: One where the user is made to pay every step of the way.

    This is a serious threat. The anti-Net Neutrality canard is being tarted up in a new dress and some dime-store lipstick, but she's still singing the same old song.

  17. Re:Govt Regulation == Bad on Net Neutrality Debate Intensifies In Canada · · Score: 2, Insightful

    This is a case where a problem is being solved by law vice technical means. Consumers should vote with their money. If ISP#1 is throttling, then stop subscribing. No other ISPs in the area? Get satellite access.

    That approach, while very commendable and principled, isn't enough.

    I've written elsewhere about why this is the case, but in a nutshell it comes down to this: Net Neutrality is a basic precondition to an end-to-end network like the Internet.

    Think of it as a law. It is, actually, if you read that in the sense that Net Neutrality is axiomatic when we talk about the Internet as designed. If this law is not adhered to, the Internet as we know it ceases to exist. Therefore, given that government's role is to enforce the law, there is a place for it in enforcing Net Neutrality.

    None of this takes anything away from your argument for consumer activism, of course. But neither alternative is exclusive of the other, and there's a clear need for both.

  18. I'm Impressed on Using X-ray Radiography To Reveal Ancient Insects · · Score: 1

    From more than 600 blocks, they have identified nearly 360 fossil animals: wasps, flies, ants, spiders.

    Six hundred blocks? That's, like, miles away!

  19. Re:The difference between F/OSS and commercial on Wireshark 1.0 Released · · Score: 1

    This project took 10 years of continuous development and public testing to reach a 1.0 release. This timeframe is not atypical; F/OSS 1.0 releases are usually stable, reliable, and heavily featured. Some projects never make a 2.0 release, instead making point releases on top of 1.0 indefinately.

    That's because with FOSS, versioning actually means something.

    1.0 means that the first version of an application is both feature-complete and stable. It's possible, of course, to have software that is not feature-complete but still stable. Wireshark is a good example of that. I've been using it for years with nary an issue.

    FOSS applications, if they're maintained by people who care about the meaning behind numeric versioning, don't roll to 2.0 (e.g. the major version number) unless the application has gone through a top-to-bottom rewrite. This has only happened once to the linux kernel, in spite of hundreds and hundreds of releases before and after the re-write.

    So, don't listen to the marketing types who tell you that bigger numbers are better. Versioning is only relevant in the context of the individual application. Something poorly re-written 6 times is not guaranteed to be better than something lovingly crafted and still not at 1.0. Compare Wireshark to a number of other traffic analysers and you'll see what I mean.

  20. It's too late! on Geeky April Fools' Day Prank Roundup · · Score: 2, Insightful

    Slashdot wont be worth coming to tomorrow... see you all on the 2nd...

    Poor silly mortal. Have you forgotten the International Date Line? April Fools is already here!

    Stories emerging from the other side of the planet:

    A NEW Google program powered by artificial intelligence allows internet users to search web pages 24 hours before they're created, the company said today.

    Yahoo! Confirms MS Merger, Name Change

  21. Re:Well, they're right, and wrong, I guess on South African Minister Locks Horns With Microsoft · · Score: 4, Interesting

    By "charity", I assume that the idea is that someone writes software with the hope of social change with no guarantee he will himself financially benefit from it. Certainly that idea has been widespread in the Free Software world, from Stallman's early dreams to even (funny how this has now gone a complete 180) Miguel de Icaza's founding of GNOME to benefit children in his native Mexico.

    Indeed. Just because people don't see it doesn't mean it's not happening.

    Do a quick Google for 'ICT4D' - Information and Communications Technologies for Development. You'll be surprised how much work is being done by organisations big and small, and by individuals, too.

    I work almost exclusively with FOSS in Vanuatu. Small linux servers running on ancient hardware was the only way we could conceivably have brought small organisations and NGOs online when I arrived some years ago.

    The server OS we use is SME Server. I worked for the company that created this software starting back in 2000. I went to work for them specifically because of this software's suitability for use in the developing world. After I left these guys, I worked for 3 years as a volunteer using the same software (and a lot of other FOSS as well) to help people communicate electronically, often for the first time.

    FOSS is critical to development work. I've written extensively about ICT and Development. This essay explains in layman's terms why FOSS is often the right tool for the job.

  22. Re:Not good enough on Patriot Act Haunts Google Service · · Score: 3, Insightful

    I was simply saying that boycotting something most people do raises a question mark against you as surely as more obvious, 'incriminating' behaviour. At least, it would if I was in charge.

    Point taken.

    ... And I'm really glad you're not in charge. 8^)

  23. Re:Not good enough on Patriot Act Haunts Google Service · · Score: 5, Insightful

    Spurning these services will mark you out for further surveillance straight away.

    'Mark you out?' The fact of the matter is, everything we transmit outside of the firewall is subject to surveillance these days. And most companies have no clue how much of their data is crossing the firewall every day.

    I don't know why people are getting their knickers in a knot over Google, when the main problem lies with the US backbone carriers, who - with only one known exception - have opened their networks to constant and widespread monitoring by US security agencies. Google at very least had the guts to fight a public legal battle with the Feds over release of even sanitised data.

    The story here may be the danger to companies when they bring these companies inside the firewall, but again, refusing to trust Google is a funny place to start enforcing data integrity. The plain and simple fact is that the greatest threat of corporate data leaks is from staff who, whether through sins of omission or commission, carry sensitive data on laptops, thumb drives, CDs without any protections whatsoever.

    I'd like to believe that data protection regimes are so advanced in these companies that the potential threat posed by Google and other online services is the main concern, but I find that impossible to do. I have to conclude, therefore that this is nothing more than a tiny kernel of truth wrapped in chocolatey FUD-ness that PHBs and corporate counsel love so much.

  24. Re:On behalf of Phorm on Berners-Lee Rejects Tracking · · Score: 2, Insightful

    I question your understanding of your own system....

    I question their understanding of what they're doing as well, based on the fact that they could send a marketing droid to debate geeks. On Slashdot.

    The only possible outcome to this kind of a conversation is for the marketer to be positively buried in technical rebuttals which he is neither equipped nor allowed to respond to. $MARKETER will receive not a little disdain in the process, and if he's not careful, will become defensive.

    The first sign of back-tracking (a perfectly acceptable way to concede a point in many business meetings) will be turned into a rout when $MARKETER finds himself faced with chapter and verse of every fallacious or inaccurate statement he's made anywhere on the web, ever. Heaven help him if he's on MySpace or Facebook.

    In short, it would be more merciful to the poor droid for us to send him straight to tubgirl right now, rather than leaving him with the false impression that there's any hope at all of emerging intact from this foray into the world of Slashdot. 8^)

  25. Re:valuable intellectual property on Neither Intellectual Nor Property · · Score: 4, Informative

    You'll know the IP lawyers are desperate when one of them brings a copyright infringement suit against someone for uploading/distributing John Cage's 4' 33".

    If you read further down the Wikipedia page, you'd know that it actually did happen:

    In July 2002 composer Mike Batt (best known for being behind the 1970s novelty/children's act The Wombles) had charges of plagiarism filed against him by the estate of John Cage after crediting his track "A Minute's Silence" as being written by "Batt/Cage". Batt initially vowed to fight the suit, even going so far as to claim that his piece is "a much better silent piece. I have been able to say in one minute what Cage could only say in four minutes and 33 seconds." Batt told the London Independent that "My silence is original silence, not a quotation from his silence." Batt eventually settled out of court for an undisclosed six figure sum in September 2002.