Slashdot Mirror


User: SL2C

SL2C's activity in the archive.

Stories
0
Comments
16
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 16

  1. Re:smoothwall--readable files on Slashback: SmoothWall, Gopher, Be · · Score: 1

    Yes, this _is_ a big deal.

    This firewall can be administered remotely. As far as I understand, this can happen via a web server. You do not have to "log in" to the firewall to break it. It is enough to convince an application running on it to do it for you. And btw, "logging in" just means that you convince some trusted application (sshd, login, and so on) to spawn a shell process for you. You do that _somehow_, not necessarily following the protocol it tries to implement. If you're an intruder, you'll maybe exploit a bug in the implementation.

    As the httpd seems to be running as user nobody, you can try to make it read/change all these files owned by nobody. Plus any world readable/writable files, of course.

    The point is that you do not deactivate security mechanisms just because you think they are redundant (because you hink another security measure already takes care of it). Redundancy is a primary strength of any secure system (not only with computers).

    Build "defense in depth". Don't create single points of failure.

    It is always possible that there is a bug in an implementation.

    It is always possible that someone can think of a way to break your security that you have not thought of.

    It is always possible that a person administering, or equally likely a person in the interior network, inadvertently, intentionally, or by beeing fooled (think trojan horses delivered by mail, social engineering, ...) opens up a hole.

    If you have only one security measure you trust, you are fucked in all these cases.

    If you have several measures that have to be broken one after the other, AND IF YOU KEEP GOOD LOGS AND LOOK AND THEM REGULARLY, then you may notice the intrusion attempt.

    To deactivate standard measures such as shadow passwords is particularly moronic.

    And to prove the point, c't have now broken this firewall design.

    I want to comment on another thing that came up in the original thread, which was by far the most depressing thread I ever read on Slashdot, starting with the posted article itself.

    This is the claim that "it just has to get the job done".

    This is not wrong in itself, but you have to think what job this is. Quick installation is not your goal, but securing your network is, and this must define what you are going to do. An out-of-the box installation whose workings and weaknesses you don't understand likely will just hurt your users (by denying them some internet services, for example) and the attackers will only laugh about it. A standard installation may protect you against known standard tools as used by script kiddies, but not much more than that. This may be convenient, but it has little to do with security.

  2. Re:No black holes here. (but Real Soon Now!) on The Next Big Particle Accelerator · · Score: 1

    I thought I had made clear that I don't believe in large ED -- not without some explanation of the dynamics that make them large and stable, determines their size and geometry (the free parameters) (same applies to string theory and compactification). But large ED is what has led people to claim that black holes might be produced at colliders and this is why I mentioned it.

    And afaik, they were not invented to create a reason for building accelerators but to solve the hierarchy problem - how can the Planck mass (as extrapolated from Newton's law in 4d) be so many orders of magnitude larger than the electroweak scale (the other popular explanation of course is supersymmetry).

    And no, the Higgs mass does not keep creeping up, it is to some extent a free parameter but correlated to the others (in the standard model -- beyond that there may or may not be a Higgs at all). If the LHC doesn't find it, the standard model is ruled out. This would quite significant -- only massless particles, no beta decay, all well established low-energy phenomena. (Unless you bring in a modified theory of frozen-out dof of course.)

    Also I'm sorry if I led anyone into thinking that HEP drives technological advance. I personally don't care so much. I just want to know -- personal itch to scratch, ESR might say. Maybe it has some use, maybe not. I think the Web came out of CERN though ;-)

    However, for (theoretical) physics, and this includes condensed matter, it has been of crucial importance. Quantum field theory, gauge theory, renormalization group were all developed in high energy, by people interested not at all in low-energy effective degrees of freedom. Later they turned out to be quite useful in condensed matter: critical phenomena, superconductivity, etc. Same thing the other way around, the most prominent example is the Higgs mechanism applied to the electroweak gauge symmetry. There are so many examples where you take concepts and intuition from one branch of physics and make use of them in a completely different field.

  3. Re:No black holes here. on The Next Big Particle Accelerator · · Score: 5, Interesting

    Actually, there is a fashionable idea in particle physics these days which goes by the name of "large extra dimensions" (large compared to the ordinary Planck length), which would bring the Planck scale, where you could expect to create mini black holes, down a lot (depending on the number of extra dimensions, geometry of spacetime in these additional dimensions, etc.) Lots of free parameters, by which you can get anything you like, much like in string theory ;-)
    Anyway, in these scenarios you do expect black hole creation a the next linear collider, or in fact even at the LHC, currently under construction at CERN.

    Also, very briefly the way experimental particle physics has worked over the last decades is to build proton and electron (possibly muon in the future) colliders alternatingly.

    With hadron (proton) colliders such as the LHC you get high energies more easily because of less synchroton radiation (charges being accelerated, including going around a curve, radiate away a lot of their energy, increasing the power you need to operate the machine. This radiation is less if the particles are heavier, as is the case for hadrons). This way you create expected (and unexpected ;-) ) particles but identification and precision measurements are hard because hadron colliders are very messy (lots of unwanted particles created along the way, giving huge background to whatever you want to look at). This is because of the more complicated laws of physics of hadrons compared to leptons (electrons or muons).
    People hope to find "the" (i.e. standard model) Higgs boson or something more unexpected (supersymmetry, mini black holes, ...) at the LHC in fact.

    Then after some time when engineering has made enough progress to bring leptons up to comparable energies, you can do precision tests on whatever you have found already. Here it can be useful to have some data available from the hadron machine.
    Anyway, you need both if you want to be sure about the laws of physics.

    The question for the US IMO is if it wants to have world class particle physics in the future. Currently the strongest hadron collider in the world is at Fermilab in Chicago. This will be made obsolete (for direct fundamental particle searches) by the LHC, which is in Europe.

    If the US fails again to build a world class machine, it will be built somewhere else in the world (Europe or Japan) and US experimental particle physics will be between in-trouble and non-existent for decades.

    (I say this as a particle physicist in Europe.)

    On the question why it fundamental physics should be done - as far as technology is concerned, there are sometimes spin-offs in the short run (such as the WWW, developed at CERN), and revolutions in the long or very long run (e.g. all semiconductor technology would be unthinkable without basic research in quantum mechanics in the first decades of the 20th century). Maybe it will happen again. Nobody can tell. Also, it's culture and it's fun. Taxpayer decides if this is interesting enough.

  4. Re:How to detect encryption on How Would Crypto Back Doors Work? · · Score: 1

    It changes entropy per bit, yes. I am sorry if I didn't use correct information theory terminology here, you are talking to a physicist :-)

    But this is what I had meant: Increase entropy (density) by compression first, then encrypt (or vice versa), to make it look like random.

  5. Re:How to detect encryption on How Would Crypto Back Doors Work? · · Score: 1

    Hmm, shouldn't it be the other way around?
    Text - low entropy - high compressibility
    Truly random data - large entropy - no compression

    Encryption should not change entropy, as it is reversible.

    A question: how would you tell an encrypted gzipped text file from random data?

    Schneier probably answers this, but I don't have the book :-(

  6. Re:When answer is to arrest the world, law is fuck on MPAA Goes After Gnutella · · Score: 1


    The law is there to protect IP rights, not to prosecute as few people as possible.If a significant portion of the population decided to start shoplifting, would that suddenly make
    it right?


    The US constitution allows Congress to grant copyrights specifically in order to promote scientific progress.
    Intellectual "property" rights are consequently granted by a society that wants to achieve a certain outcome. They are fundamentally different from real property rights, and certainly are not "natural" rights.

    The reason why the computer users are prosecuted are financial interests of the companies involved, and those alone are by no means a reason to grant copyrights, at least not in the framework of the US constitution.

    Of course the real interesting strategy would be to find some alternate powerful (in the sense they can afford to lobby legislation) economic player that would actually profit from people sharing files over the internet.

    With point-to-point traffic predicted to overtake downloads of centralized content soon, it is clear who this is: The ISP's and infrastructure providers (phone companies, network equipment manufacturers etc.)

    I would not be surprised if this will be reason enough, in the end, for the ISP's and others not to cave in.

  7. Re:Library at Alexandra on The Right To Read: Time Limited Textbooks · · Score: 1

    You are right, I was quoting a story I had read a long time ago and it involved the Koran "argument" you quoted above, so that was how I came to mention the Turks.

    Anyway, I would like to retract my posting altogether.

    I have checked a few web pages such as
    http://www.unesco.org/webworld/alexandria_new/
    http://www.bibalex.gov.eg/
    (the latter contains a description of the history of the ancient library, at
    http://www.bibalex.gov.eg/ancient_library.htm,
    which also lists the sources of the various claims/stories.)

    It seems that the library was damaged, books taken away or destroyed, etc. many times during the third and fourth centuries out of a variety of motives, including also the anti-pagan riots incited by Christian leaders.

    The story regarding Omar seems to have been made up in the 12th century according to a lot of historians, as it seems that it was mentioned first around that time but never between 640 and the 1100s.

  8. Re:Library at Alexandra on The Right To Read: Time Limited Textbooks · · Score: 1

    The library burned twice (at least).
    Once around (during?) Caesar's or Augustus' time, this is what you are refering to.
    Then it was destroyed a little before the year 500 out of "religious" motives by "the" Turks (who weren't Christians).

  9. Re:Creationism vs Evolution vs Q.Evolution==Icky on Quantum Evolution Poses Challenge to Darwinism · · Score: 1

    Evolution does not violate the 2nd law.
    The 2nd law states that entropy in a _closed_ system cannot decrease (in fact, will increase).

    The earth is not a closed system.

    In the case of the earth, you also have to take into account the radiation from the sun absorbed by the earth and that radiation that is emitted from the earth.

    The earth emits as much energy as it absorbs (it does not heat up or cool significantly as a whole), but the emitted, low-frequency radiation carries a lot more entropy than the high-frequency photons coming from the sun. The quick way to see this is that the low-frequency radiation consists of many more photons, which can together be in many more configurations, and therefore has higher entropy.

    So even with the entropy of the earth, or at least of the biosphere, decreasing, the overall entropy can increase quite a bit, satisfying the 2nd law.

    A similar thing happens in a thermodynamic engine: Take some energy Q1 from a high T reservoir. This takes S1 = Q1/T1 entropy from the high T reservoir.
    Then give this (or a little more) entropy to a low-T reservoir : This only costs energy Q2 = S1*T2
    The difference in energy can in principle be used to do mechanical work, while still satisfying the 2nd law.

  10. Tranlation on Windows 2000 to be banned in Germany? · · Score: 3

    Windows 2000 in danger of being banned

    A component of Windows 2000 was made by a scientology company. The defragmentation program "Diskeeper" is scheduled to be shipped in February as a standard part of the NT successor.
    It is being developed by the firm "Executive Software" of the confessing [?] scientologist Craig Jensen, as has been reported in c't issue 25/99. The connection between the psycho trust and the software giant is a thorn in the side of the large churches.

    "This will not be interesting to the Catholic Church alone, but also to the states, the Verfassungsschutz [one branch of the secret service] as well as the German industry", Harald Baer, catholic commissary for sects and wold outlook issues [Weltanschauung issues], commented to the German press agency (dpa). According to Ursula Caberta, leader of the Scientology working group of the Hamburg interior authority, Executive Software is one of the leading businesses in the Scientology organization WISE (World Institute of Scientology Enterprises). [She says] WISE is "the decisive branch of Scientology in order to infiltrate and spy on the economy". In the states of Bavaria and Hamburg, there have been resolutions according to which authorities, in particular in the area of information technology, are not allowed to buy services from scientology businesses. (em)
    (cp/c't)

  11. Re:Cool, so now I can go back in time? on Reverse Time Could Explain Dark Matter · · Score: 1

    On page three of the article (the one by Schulman), in the last paragraph, he asks not this question but a related one - is it possible to learn to know about the future (in the example given, an observer in the opposite-thermodynamic-arrow-of-time region notices that it starts raining in "our" world and subsequently sends a message to us, which we receive before it starts to rain, thus enabling us to close the windows).

    Since microcausality still holds (and can be proven for a given theory - such as the standard model, for example), I do not think there would be a way to CHANGE your past.

    Rather than that, you _might_ be able to look into your future. However, I doubt that this will be much different from predicting the future by physical laws (in fact it is the same, since he looks at systems where the laws are known).
    This would probably have to be a deterministic prediction (I mean one that you can not influence by a "free will" decision) in order to avoid paradoxes. The author refers to an older article for this.

  12. Re:Interesting point (on contracts and 18) on Bruce Perens Discusses Lawsuit Against Corel (UPDATED) · · Score: 1

    But if someone can not legally enter into a contract, and the contract (or GPL license agreement) is therefore void (or whatever the appropriate legal term is), doesn't this simply mean that the person does NOT get the right to redistribute the code?

    I think the situation is this:
    A gives B a copy of a GPLed program, with A being either the author (copyright holder) or being allowed to do so via the GPL.

    The GPL gives B the right to redistribute copies under certain conditions (such as doing so under the same licenseing terms), which right B would not have without the GPL.

    If B did not legally agree to the contract/GPL, and B gives the software to someone else, B is simply infringing on the author's copyright!

    This is exactly the same situation as if B would copy a commercial, copyrighted program and give the copy away!

    For example, if a minor gets some cool game from their parents as a present and then copies it, that's surely copyright infringement even though he is a minor?

  13. Warp travel links on Testing the Theory of Relativity · · Score: 1

    The warp paper mentioned in my other post is at

    http://www.lysator.liu.se/~nisse/doc/alcubierre/


    Also there is a news article mentioning some of the ideas at

    http://news.bbc.co.uk/hi/english/sci/tech/newsid _364000/364496.stm

  14. Re:Gravity does not move infinitely fast! on Testing the Theory of Relativity · · Score: 1

    Well don't throw in the towel so quickly :-)

    Actually it might be possible to move effectively faster than light WITHIN general relativity.

    One idea is wormholes but I believe it is not clear, or rather, doubtful, that wormholes can be generated and made stable at all.

    Anyway, the speed limit is a local thing: You are not allowed to move faster than a light beam next to you, but actually if you can warp the spacetime in a clever way you could possibly travel arbitrarily fast, as seen from far away (although a light ray coming in from the behind would be even faster!)

    I remember a physicist, M. Alcubierre, describing such a "clever space-time geometry" but unfortunately I can't locate the paper on the web anymore. It's published in Class. Quant. Grav. though, in case you have access to a physics library... That paper was serious, the best thing being that the distortion needed is PURELY LOCAL, just a few meters around the "USS Enterprise". The problem was that in front of the spaceship you need a negative energy density. This is frowned upon in classical physics but possible in principle in quantum theory.

    You can also search arxiv.org (aka xxx.lanl.gov), the physics preprint archive, for the word "warp" or "warp drive"; you'll be surprised about the number of titles showing up.

  15. Gravity does not move infinitely fast! on Testing the Theory of Relativity · · Score: 1

    Gravity waves move at the speed of light just like excitations of any other "massless field" (The field is the local geometry of spacetime itself). This "speed limit" is in fact necessary for the theory to be relativistic in the first place (i.e. not having a preferred frame of reference). The principle of (special) relativity o.t.o.h. is really well established, if gravity would violate it, we would most probably have seen the effects already (for example, in the original Michelson experiment which failed to find any velocity of the Earth w.r.t. the so-called "aether", which would have been a preferred frame, at any time of the year).

    Since gravity waves are a feature of any field theory of gravitation, such as GR, they had better be found or not only would GR be ruled out but also any theory of gravity based on our understanding of classical and quantum field theory. Although for LIGO to detect it, the waves will have to be pretty strong (some not-too far supernova for example might do). Next-generation experiments are expected to be able to detect waves that originate from more common sources such as close binaries (mentioned in an earlier post).

    On a more fundamental note, you never prove a scientific theory, you only (try to) disprove (falsify) it. In Einstein's words, "no amount of experimentation can ever prove me right, but a single experiment can prove me wrong."

  16. Re:You can't have it both ways on The Rise and Rise of Software Patents · · Score: 1

    Algorithms are formalized ways of thinking. And they are mathematical objects just as other "formulas" (I don't know of a precise definition of the word "formula").
    For example, you can ask if an algorithm terminates etc. Might even be able to prove if it does or does not (though not by applying some general algorithm :) )

    A major problem with patents on algorithms is then
    that it restricts your freedom to communicate your thoughts. This is particularly true for free software since (in my view) free software is, among other things, a way of showing other people ways of thinking - or ways to use their computers intelligently - and to encourage them to make improvements.

    Restricting this freedom by allowing patents on algorithms is IMO a blatant infringement upon free speech.

    "Features" such as a certain desktop layout or the "Save As" method are an entirely different thing. Here the guideline for patent laws should be "how do we encourage innovation/progress/etc." (Personally I think patents on these things are bad, too.)