Slashdot Mirror


User: mcelrath

mcelrath's activity in the archive.

Stories
0
Comments
650
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 650

  1. Re:encrypted password file on Study Shows "Secret Questions" Are Too Easily Guessed · · Score: 1

    For stupid websites you don't care about, why not just have a standard 'insecure' logon/password combo to use for all of them?

    I do. But sometimes sites won't accept my password because it doesn't contain the right magic combination of numbers/letters/punctuation/length, or my desired userid is taken...

    Mostly here I'm talking about saving passwords for business sites: frequent fliers, banks, credit cards, any online merchant, etc. The paranoia is required because somewhere in the bowels of there website is my credit card number or other sensitive information.

  2. Re:encrypted password file on Study Shows "Secret Questions" Are Too Easily Guessed · · Score: 2, Insightful

    So why bother saving the answers to secret questions? If you're not going to lose the password, surely you won't need the answers to the secret questions. And if you lose access to the password file, you've also lost the answers to the secret questions.

    Just in case. You never know when a password gets grabbed by e.g. a keylogger, network sniffer, or insecurity on the server side.

  3. encrypted password file on Study Shows "Secret Questions" Are Too Easily Guessed · · Score: 3, Insightful

    I just keep a gpg-encrypted file with all my passwords. When sites ask these retarded questions, I just generate a long random alphanumeric string (using a little perl script), and save it in my gpg file. This file is heavily backed up. I cannot imagine a scenario where I would lose a password, or the answers to "secret questions".

    The only time I've had a problem is with stupid websites that require registration (and I don't care about, so didn't write down the gibberish I wrote in their registration form) and some time later I decided to come back to that stupid site.

  4. Re:What about the audio...? on Ubuntu 9.04 RC Released · · Score: 2, Informative

    It looks like it's also necessary to add a line to /etc/security/limits.conf otherwise you still won't be able to grab realtime priority.

    Thanks! I'm running real-time now. Now to do something dumb and make it swap...or I'll just wait a couple days until firefox goes over 2GB memory usage. (yes!)

  5. Re:What about the audio...? on Ubuntu 9.04 RC Released · · Score: 1

    Default linux now has realtime priorities (SCHED_FIFO, SCHED_RR) which apply to the scheduler, and bypass the normal "nice" system for allocating CPU time. It doesn't require a -rt kernel. That's something different. -rt is related to reducing *kernel* latency, which will certainly help, but the skipping happening now is due to userspace contention for the CPU, not kernel interrupts.

  6. Re:What about the audio...? on Ubuntu 9.04 RC Released · · Score: 2, Informative

    The current audio daemon being distributed by Ubuntu is pulseaudio. This has, for the last several releases, been a horrible pain in the ass. After the pain that was esd and artsd, I don't know why anyone decided to try another one. It appears the pulseaudio developers released an unfinished codebase into the world, and managed to get it into ubuntu. So for the last several releases (8.04 and 8.10 at least) audio has been a massive pain. Apps would crash, pulseaudio would crash, sound would not be present or wouldn't mix properly between apps. Flash video was particularly bad at taking down both firefox and pulseaudio. Skype was unusable.

    However I must say that with 9.04 the situation is substantially better. (I upgraded to the Jaunty alpha specifically for the pulseaudio updates because 8.10 was unusable for certain combinations of audio-producing apps). I now reliably have music (rhythmbox) occasional browser noises (flash), wine games, video (vlc/miro/mplayer) and system sounds properly mixed with no crashing of the apps or the pulseaudio daemon. The pavucontrol control panel properly displays all the audio-producing apps and lets you individually mute them or control their volume.

    A drawback to putting everything in userspace is that if your system becomes loaded or starts to swap, the audio will skip. Fortunately this doesn't cause any apps to crash, but is pretty annoying. It should be possible to eliminate this using real-time priorities, but I haven't investigated that yet. As far as I can tell there's no command line 'renice' program for realtime priorities. (I had one a long time ago, 'setrealtime' but it was a small piece of code I compiled myself)

    So the summary is...the situation is better than it has been for several releases (more than a year, at least). But still worse than using the ALSA's built-in software mixing (which runs in kernel mode, I believe, and doesn't skip).

    To answer your final question, I believe these daemons intercept calls before they get to the kernel. There is a library which can be LD_PRELOAD'ed which intercepts kernel calls (padsp). But since most apps these days are aware of two or more of {pulse, alsa, oss, esd, arts, jack}, configuring audio is rather a pain. All apps needed to be rewritten to take advantage of pulse. But at this point the important ones have (gnome apps) and some important ones that haven't (wine,skype) work.

    The situation is improving, but ubuntu needs to configure realtime priorities for pulse by default, and we need to start killing off legacy sound daemons and interfaces. Linux audio is a mess.

  7. Re:Protect yourself on The Low-Intensity, Brute-Force Zombies Are Back · · Score: 1

    By the way, you can look at the traffic statistics from DenyHosts, you can clearly see that ssh password-guessing traffic increased about 10 fold on Apr 6. (And since I configured DenyHosts to email me every time it blocks an IP, I've been very aware of this attack)

    I've always wondered why someone doesn't do something with the DenyHosts IP list. It should be impossible to forge IP's for ssh, due to handshaking and key exchange. So doesn't DenyHosts have a pretty good map of somebody's botnet? Is any law enforcement agency or ISP using this information? I'm really fscking tired of hearing about attacks, and having law enforcement not appear anywhere in the conversation or articles. If people were systematically making physical keys and trying them on people's houses, you better believe the police would be involved. How is this any different?

  8. Re:have your own domain-get universal forwarding on Spam Replacing Postal Junk Mail? · · Score: 1

    I've been doing that for years and years, and as another commenter notes, many websites are not compliant with the RFC, and refuse to allow + in email addresses. Not complying with the RFC should be a prosecutable offense, but I digress...

    So I added underscores too. Everyone accepts underscores. In sendmail.cf you need to modify OperatorChars and add a rule copying the + rule. Look for 'R$+ +' starting a line.

    But in practice, I've never actually done anything with these tagged email addresses. I get so much spam that it's not worth my time to hassle with it anymore. I just save it to my spam folder and Spamassassin trains on it, and soon I never see it.

    When, oh when, will our law enforcement step up to the task? I'm tired of these criminals wasting my time and money.

  9. Re:HeLa cells? on Cotton Swabs are the Prime Suspect In 8-Year Phantom Chase · · Score: 1

    The HeLa story makes me wonder if the contamination could be from a 200-year old cotton picker with skin cancer lesions on her hands. If HeLa cells are so hardy, it seems possible that such cells could survive within the cotton processing machinery, or even as a parasite living on the cotton itself. Humans could also have transferred some genes to some strains of cotton, which continue to be grown... The HPV virus which caused gene transfer in the HeLa case has variants which live on the skin.

  10. Re:Great 4.5 Year Show, Weak Ending on Battlestar Galactica Comes To an End · · Score: 1

    The actual mitochondrial eve has a mitochondrial DNA that is different from her mother, by definition. There was a mutation that occured at that point in our genetic history. Another way to introduce this mutation is to inherit it by cross-breeding with another species. Since Athena is NOT human, the mitochondral DNA could have been inherited from her, but that doesn't make her genetic eve. (She's not human)

    And it doesn't mean having lots of sex. Just more than two children, on average, and the others eventually have to be bred out. She's important in the same way as your great-great-grandparents. They had to exist, and they give you your genetics, but that's about all.

  11. Re:Two changes that could've been made on Battlestar Galactica Comes To an End · · Score: 2, Insightful
    Did you somehow get the idea that somewhere in the fleet they had a pencil, book, or antibiotic manufacturing facility?

    I think they hit the end of their rope. They have no resources, no fuel, no food. They have no choice but to abandon their ships and live on the surface. On top of that, they're all emotionally devastated.

    That's what I got out of the ending. That most characters were so emotionally devastated by the last four years that they wanted to crawl in a hole and die. If I could go live in a quiet cabin in the mountains after that, I probably would.

  12. Re:Bah! Leave It Alone on Will the FTC Target EULAs Next? · · Score: 1

    "To make laws that man cannot, and will not obey, serves to bring all law into contempt." -- Elizabeth Cady Stanton

    In other words, we're training a generation of people to ignore and disobey the law. (In this case, contract and copyright law) Then, when we create truly important laws, we will wonder why everyone ignores it. The law must be brought in line with actual practices, or it is useless. Defining a large segment of the population as criminals is a great way to create a fascist government, but pretty useless for a democracy.

  13. Re:Leave well enough alone on New Law Will Require Camera Phones To "Click" · · Score: 1

    Sounds like undue burden to me. How about regular digital cameras? Or webcams? Or ultra-portables with webcams? How about security cameras at stores? Should they make a continuous tone?

    Why should makers of "phones" be discriminated against in this way? If I reclassify an iPhone as a "portable internet device" do I get around the regulation?

    Cameras are now ubiquitous, unfortunately, and we just have to live with the consequences of that. We can no more prevent them from taking pictures than we can prevent them from seeing. This is the video equivalent of the broadcast flag, except they want to apply it to anything you can see. It will fail.

  14. Re:Maybe there's already been a persistent black h on Black Holes From the LHC Could Last For Minutes · · Score: 1

    Because I work at CERN, and that's the injection energy of the SPS. They had not started to ramp the magnetic fields in to get to higher energies. The planned first collisions were at 450 GeV (and ramp afterwards), which never happened.

  15. Re:Maybe there's already been a persistent black h on Black Holes From the LHC Could Last For Minutes · · Score: 1

    The LHC never had any collisions before the accident. The energy of the beam was only 450 GeV (injector energy) which is the energy of a previous experiment (UA1 and UA2), and much less than the 1800 GeV currently running at the Tevatron in Chicago. There were no black holes. It was a quench in a superconducting connector. Melted, arced, punctured helium vessel, and exploded.

    Now stop your fear-mongering speculation and go find something useful to do with yourself. People have died because of stupid fear-mongering like yours.

  16. Re:The fact that there is some doubt on Black Holes From the LHC Could Last For Minutes · · Score: 1
    You should read this: On The Statistics of Improbable Things.

    "It is the dull man who is always sure, and the sure man who is always dull." -- H.L. Mencken

    "Doubt is not a pleasant mental state, but certainty is a ridiculous one." -- Voltaire

    "Convictions are more dangerous enemies of truth than lies." -- Friedrich Nietzsche

  17. Re:Does it fix the annoying wireless disconnect is on Ubuntu 8.10 (Intrepid Ibex) Released · · Score: 1

    This seems to be a problem with 802.11b itself and some base stations, and is usually due to interference. The base station and/or the card drops the connection for ~minutes on a regular basis. I've seen it on windows too. I doubt NetworkManager updates will be able to fix it.

    You can try switching to a different channel. Use iwlist eth1 scan to get a list of visible AP's, and select a channel that is not used. Remember that the frequencies overlap so in reality there are only 3 usable channels: 1, 6, and 11.

    I would love it if other people had more/better information. It's infuriating that the base station/card drops the connection. It should re-establish it as soon as the interference is gone. It would also be nice to be able to figure out what's going on in the relevant frequency ranges...

  18. Re:Summary is incorrect on Cray's CX1 Desktop Supercomputer, Now For Sale · · Score: 1

    So what does that mean practically? This looks like a cluster-in-a-box, connected internally with gigibit ethernet or infiniband. As in, I have to use MPI code to utilize all the processors. If I run "top" I will see at most 8 CPU's on the current node. So cannot processes be automatically migrated to another "node". Do I have to ssh into the second "node" to access the 8 CPU's sitting there?

    This seems...not that clever.

    Please correct me if I have misunderstood what this thing is. And ditto from another comment...why not just buy a rack and put 8 1U's in it for a lot cheaper? It looks like that would be identical.

  19. Re:There is hope on Recovering Moldy Electronics? · · Score: 1

    It's called capillary action. Smaller gaps suck water harder, due to the water's high surface tension.

  20. Re:Time for a new protocol on Every Email In UK To Be Monitored · · Score: 4, Insightful

    Origin and recipient? So they can tell the 98% of the email that arrives at my inbox that is spam, where the origin and recipient are forged, without looking at the body!?!? Please, share that tech with us, oh great and mighty Police State Overlords.

  21. Re:Fallow-Field Legislation on Millions of Internet Addresses Are Lying Idle · · Score: 1

    I know how to divide by 2. And -1 for that matter.

  22. Re:Fallow-Field Legislation on Millions of Internet Addresses Are Lying Idle · · Score: 1

    This sounds like a great idea for IP=Intellectual Property.

    If you do not, or cannot make money from your IP "rights" within the last 5 years, then that IP enters the public domain.

  23. Re:Exxxcellent on International Spam Ring Shut Down · · Score: 1

    My concerns though are the 35,000 computers being used to spam.

    I've been wondering for some time now: does anyone have a botnet map? Surely, I should be able to make a decent botnet map just from my server logs alone. Something along the lines of denyhosts. They can't all be on dial-up and I assume forging IP's could be dealt with with a large enough dataset.

    I want the botnet IP list to block at the SMTP level, or perhaps just dump them all in /etc/hosts.deny. Or, of someone is a good Samaritan, find a way to contact these people and get their computers cleaned.

    Since the Samaritan cause is probably a lot of thankless work, one should probably set up a system like denyhosts, where the botnet IP's would be blocked by participating server administrators, and those IP's redirected to a botnet list indicating the problem to them, and how to get their IP removed from the botnet list. (Just like spam blacklists work now)

  24. Re:The US can't do big science on Next-Gen Mars Rover In Danger of Cancellation · · Score: 2, Informative

    I'm to young to really have a full comprehension of the politics at the time...but the cancellation was due to both some financial mismanagement, and competition with the International Space Station, which ran to 100 billion. I hear stories about how biologists were going to their congress-critter's office complaining about how the "proton racetrack" was going to cause them to loose all their funding. It's disgusting that different disciplines have to compete in this way. But if congress decides one day that project A is interesting, it should complete project A. When project A takes 12 years, and project B comes along after 2, and congress decides to switch funding from project A to project B...no project will ever be completed.

    As I said, fire some bureaucrats, hire some auditors, help keep it on budget and avoid over-spending. But make sure the science gets done.

    All that said, cooperating on international projects is a fantastic idea, and the US contributions to CERN should not be discounted. But a little competition greases the wheels of discovery.

    Note that this year, the ITER funding was zeroed, and Fermilab was cut by $94 million, a change which required "voluntary" rolling furloughs. This was partially fixed by a supplemental funding bill in June, but due to the current budget crisis, the 2009 budget is passed under a "continuing resolution", which means that Fermilab is short and ITER is zero again, and we have to again grovel before our congress-critters for funding, which is highly unlikely since Wall Street is obviously more important than science.

    The US is at a serious disadvantage.

  25. I struggle too on Give Up the Fight For Personal Privacy? · · Score: 3, Insightful

    I struggle with the same problem. Some time ago I signed up for a facebook account, but declined to approve the "how we know each other" things my friends posted when they added me as a friend -- that crossed a line. Eventually I caved and approved all of them.

    Personal privacy is not something that's terribly important until someone uses it against you. Society has to get used to the fact that the boring guy in accounting may actually attend kinky parties, and that's not a reason to fire him. Loss of privacy enables discrimination, and there must be a counterbalancing force to that. The optimistic side of me thinks that this will make society more tolerant. The other side sees that it will cause harm to a lot of people in the short term.

    Police and courts must be enabled to the same information (and there's no reason they can't get that info now...). So when the accountant at the kinky sex party is fired, he can sue for discrimination. I do expect a rash of court cases of this type over the next 10 years. Fortunately they should be easy to win.

    But I think the most serious consequence is in politics. Or, areas of life where fact is secondary to appearance. I've never felt terribly concerned about any details about myself...just ask and I'm sure I'd give you way more information than you could find in facebook. But, it's the principle of the matter, and the capability of unscrupulous people to do unscrupulous things. Not necessarily to me... but the capability of (say) one political party to prevent another political party from showing up for a vote by putting their names on a terrorist watch list, or by calling a raid on a party they know they attended because it was on Facebook Calendar. This kind of openness enables your enemies just as it enables your friends, and I don't know how to counter this change. It's clear the US anyway has political parties willing to blatantly lie about each other (e.g. Palin - Obama "palling with terrorists"), it's not that important that they have actual facts they can distort for their lies. Without this kind of openness, they would make things up anyway.

    So, transparency of information will cause (a) stronger anti-discrimination laws and (b) difficulty for anyone in politics. This could be the end of functional democracy.

    I also think the internet should be making people smarter. I'm still waiting on serious data to back that up...it also seems to give idiots a place to congregate.

    So in conclusion, I have no conclusion. Things are changing. I don't know yet whether it's good or bad.