Slashdot Mirror


User: NoBozo99

NoBozo99's activity in the archive.

Stories
0
Comments
68
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 68

  1. Were they H1-B mosquitoes? on Bill Gates Unleashes Swarm of Mosquitoes · · Score: 1

    I'm just saying! (ducks)

  2. Re:Let's cut the conspiracy theory on When Teachers Are Obstacles To Linux In Education · · Score: 1

    I had to fire up cygwin and type in:
    $wtf TANSTAAFL

    to find out what TANSTAAFL meant. lol!

  3. Re:For the love of FSM... on Sun Unveils RAID-Less Storage Appliance · · Score: 1

    Yep! Sun is aim this at customers and potential customers of NetApp. I'd be worried if I were NetApp.

  4. Re:Whacked upside the head ... on Higher Oil Prices Are Starting To Bring Jobs Home · · Score: 1

    ... by The Invisible Hand.

    Adam Smith strikes.

    Hopefully, more like bitch slapped by The Invisible Hand!
  5. Re:If I had the power to do it all over again... on New Grads Shun IT Jobs As "Boring" · · Score: 1

    I'd go into Library Science and get an MLS. May not pay the most, but at least you aren't stuck doing 50 or 60 hour work weeks, high stress levels, and job insecurity.

  6. don't forget the health-care benefits. on H-1B Foes Challenge Bush Administration In Court · · Score: 1

    iirc Norway has a pretty decent universal health-care system.

    I'm assuming you are a Norwegian citizen then?

  7. Marcus Ranum's Six Dumbest Ideas on Antivirus Inventor Says Security Pros Are Wasting Time · · Score: 1

    Software / Hardware security is not too difficult to achieve. If an admin is truly competent they will have no problem getting their lab workstations up and running cleanly and bug free with pretty solid security.

    The issue is usually the idiot that becomes the victim of a well done social hack.

    As usual, the company is only as strong as it's weakest link.

    ...in Computer Security.

    Dumb Idea #3

    #3) Penetrate and Patch

    There's an old saying, "You cannot make a silk purse out of a sow's ear." It's pretty much true, unless you wind up using so much silk to patch the sow's ear that eventually the sow's ear is completely replaced with silk. Unfortunately, when buggy software is fixed it is almost always fixed through the addition of new code, rather than the removal of old bits of sow's ear.

    "Penetrate and Patch" is a dumb idea best expressed in the BASIC programming language:

    10 GOSUB LOOK_FOR_HOLES
    20 IF HOLE_FOUND = FALSE THEN GOTO 50
    30 GOSUB FIX_HOLE
    40 GOTO 10
    50 GOSUB CONGRATULATE_SELF
    60 GOSUB GET_HACKED_EVENTUALLY_ANYWAY
    70 GOTO 10

    In other words, you attack your firewall/software/website/whatever from the outside, identify a flaw in it, fix the flaw, and then go back to looking. One of my programmer buddies refers to this process as "turd polishing" because, as he says, it doesn't make your code any less smelly in the long run but management might enjoy its improved, shiny, appearance in the short term. In other words, the problem with "Penetrate and Patch" is not that it makes your code/implementation/system better by design, rather it merely makes it toughened by trial and error. Richard Feynman's "Personal Observations on the Reliability of the Space Shuttle" used to be required reading for the software engineers that I hired. It contains some profound thoughts on expectation of reliability and how it is achieved in complex systems. In a nutshell its meaning to programmers is: "Unless your system was supposed to be hackable then it shouldn't be hackable."

    "Penetrate and Patch" crops up all over the place, and is the primary dumb idea behind the current fad (which has been going on for about 10 years) of vulnerability disclosure and patch updates. The premise of the "vulnerability researchers" is that they are helping the community by finding holes in software and getting them fixed before the hackers find them and exploit them. The premise of the vendors is that they are doing the right thing by pushing out patches to fix the bugs before the hackers and worm-writers can act upon them. Both parties, in this scenario, are being dumb because if the vendors were writing code that had been designed to be secure and reliable then vulnerability discovery would be a tedious and unrewarding game, indeed!

    Let me put it to you in different terms: if "Penetrate and Patch" was effective, we would have run out of security bugs in Internet Explorer by now. What has it been? 2 or 3 a month for 10 years? If you look at major internet applications you'll find that there are a number that consistently have problems with security vulnerabilities. There are also a handful, like PostFix, Qmail, etc, that were engineered to be compartmented against themselves, with modularized permissions and processing, and - not surprisingly - they have histories of amazingly few bugs. The same logic applies to "penetration testing." There are networks that I know of which have been "penetration tested" any number of times and are continually getting hacked to pieces. That's because their design (or their security practices) are so fundamentally flawed that no amount of turd polish is going to ke

  8. Re:Very odd on Microsoft Bids $44.6 Billion For Yahoo · · Score: 1

    Regulators? We don't need no stinking regulators!

    Given the current administration's corporate friendly ways
    do you seriously believe the regulators would stop this?
    Think News Corp taking over the Wall Street Journal or the
    reassembly of ATT's death star from its former Baby Bells.

    The big question is... What happens to all the support and
    good will that Yahoo gives to the open source community?
    What happens to Zimbra (as an example) if M$ takes over Yahoo?

  9. Poor babys on Young IT Workers Disillusioned, Hard to Retain · · Score: 1

    Cry me a river!

    There is no shortage of qualified people out there, just a shortage of cheap labor.

  10. Not really on Humans Evolving 100 Times Faster Than Ever · · Score: 1

    He died in his sister's house of pneumonia. Yes. He was in an psychiatric clinic for a while, but didn't die there.

  11. Hmmm. I see a Ballmer throwing a chair... n/t on Microsoft Wants To Give You A Rorschach · · Score: 1

    Duck!

  12. good reason to shop at powells or bookpool. on Amazon Patents Bad Service For Bad Customers · · Score: 1

    I haven't made any purchases from amazon in the last year or so.

  13. Re:ask a lawyer on Non-Compete Agreement Beyond Term of Employment? · · Score: 1

    "At will" is secret code meaning you are our slave now.

  14. safety protocols on High-Tech Vest Lets Gamers Take a Hit · · Score: 1

    Captain! They've removed the safety protocols on the holodeck!

  15. missile silos on Data Centers in Strange Places · · Score: 2, Insightful

    I wonder why someone hasn't thought of using a abandon missile silo as a data center.

  16. We manufacture lots of hambergers at Mickey D's! on Indian Software Firm Outsourcing Jobs To US · · Score: 1

    And freetraders/supplysiders still manufacture plenty of bullshit here too!

  17. chkconfig anyone? on Hardening Linux · · Score: 1

    Last time I looked (at least on redhat systems) chkconfig can show you which services are running
    and disable the ones you don't want running.

    chkconfig --list
    chkconfig nscd off

  18. Geek Rapture? on William Gibson Gives Up on the Future · · Score: 1

    Does this mean Scotty will finally beam me up?

  19. I like my trojan to have a custom fit too on Custom Trojan Creation Tool Sold Online · · Score: 1

    with ribbing to please the ladies. ;-)

  20. Re:Socialised Healthcare is the future for the US on Massachusetts Makes Health Insurance Mandatory · · Score: 1

    The Swiss model is nothing like the Mass model. Insurance companies in Switzerland are tightly regulated by the government and IIRC nonprofit. American insurance companies are for profit and don't have anything near the regulatory oversite that swiss insurance companies have.

  21. Massachusetts law good for insurance companys, on Massachusetts Makes Health Insurance Mandatory · · Score: 1

    but bad for people. Massachusetts law isn't "socialized medicine" it is corporate welfare for the insurance companies. Support single payer universal health care legislation such as California SB840 and/or the bill in congress HR676.

  22. You are in a maze of twisty little passages, on The History and Future of Zork · · Score: 1

    All alike.

  23. Netbeans anyone? on Linux Programmer's Toolbox · · Score: 1

    IIRC netbeans runs on linux platform fine and has addon for c/c++.
    http://netbeans.org/

  24. There's a hole in your mind... on Massive Cave Found on Mars · · Score: 1

    Its a shadow listening base!

    Where is ambassador Kosh when you need him?

  25. Over 1/3 of healthcare costs=insurance companys on Can Technology Fix the Health Care System? · · Score: 1

    The overhead due to the forms that doctors offices have to deal with amount to 1/3 the cost of health care in this country.

    Ever wonder why the United States spends more on health care and gets so little in return in comparison to other capitalist industrialized nations? Because, they have nationalized health care and they don't have a for profit health insurance industry.

    BTW - Why are our emergency rooms overflowing? Because people that don't have health insurance tend to put off going to the doctor till the very last gasp. What is the most common reason for people filing for bankruptcy in the United States? Answer: Catastrophic
    health problems (like cancer, Diabetes, etc).

    One more thing... 8 million children in the United States have no health care coverage in the United States.