Slashdot Mirror


User: jarran

jarran's activity in the archive.

Stories
0
Comments
151
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 151

  1. Sort of on Gates: 'You don't need perfect code' for Security · · Score: 1

    Much as I hate to find myself agreeing with Bill, there is an element of truth in what he says. I'd never leave my Linux box on the net without a firewall.

    Adding this extra layer of security doesn't mean you don't need to have perfect code, but it does mean that a lot less of your code has to be perfect.

    In other words, I can never be reasonably sure that all the services running of my box are secure. But by having a firewall and blocking services, it suddenly matters a lot less whether those services are secure or not. It does matter a lot whether the firewall code itself is secure, but that is a much smaller amount of code than all the services I am running.

  2. Too late! on AT&T Moves Toward Mail-Server Whitelist · · Score: 1

    We're already there. I've been running my own mail server on my ISP connection for a few years. A few months ago this became completly untennable, and I had to go back to my ISPs slow, unreliable server.

    Why? The sheer number of servers that were refusing mail from me because my IP was from an ADSL pool.

    The Internet has already been de-democratized, long ago.

  3. Re:I've always thought on Baffling the Spam Bots · · Score: 1

    These same people if I were verbally giving them the url to slashdot would end up at http://www.slash..org/ (god I wish I were trying to make a joke but seriously I've had this happen).

    Or even http://www./..org/

    But anyway, that's a Good Thing. We don't want these people to be able to find Slashdot.

  4. Re:CAPTCHAs are not the answer on Baffling the Spam Bots · · Score: 1

    We need a more realistic, permanent solution. For example, cryptographically authenticating the sender

    Unfortunately, the difficulty is not with implementing such a system.

    The problem is finding some sensible migration path from the way e-mail currently works, to the way we want it to work.

    In an ideal world we would say "Right, from 01/01/2004 we will be switching off SMTP and everyone has to use the new system." But the distributed nature on the internet makes this very hard.

    But how phase in a new system gradually? Any new system needs a way for people to recieve e-mails from people still using standard SMTP. Otherwise, people will not use it because the early adopters won't be able to receieve e-mail from anyone.

    During this period of changeover, spammers will obviously continue to use SMTP. This in turn means there is no incentive for people to upgrade to the new system, because it won't stop spam until it reaches the critical mass where people decide they can start refusing unauthenticated users. (Which is probably going to be something like 90% of users.)

    Even though it is really ISPs that would decide to make this change rather than users, the same argument still applies. There will be a cost associated with implementing the new system, and an ISP won't get any benefits until a majority of other ISPs have implemented it. So ISPs would be have to make a huge gamble that the system is going to work long before there is any evidence that it will work.

    I'm not saying that these problems can't be overcome. I'm saying that the cryptographic authentication is the easy part, as it's already well understood. On the other hand, deploying the system in a sensible way is NOT well understood, the evidence for this being that it's not yet been done.

  5. Re:Not an assumption on Praying Doesn't Help · · Score: 1

    I think that this is a distortion of language. Under your definition, a person would stop believing something when it was proved to them.

    For example, say you noticed that all your friends who worked in a local chemical plant died from cancer. You might say "I believe that the chemicals being produced in that plant cause cancer." Say you devised an experiment and proved that this was indeed the case. Under your definition of "believe", after the experiment you might say "Now I have conducted my experiment, I do not believe the chemicals produced in that plant cause cancer."

    But this is clearly contrary to common usage of the word. "believe" means that you accept something is true, it doesn't matter what caused you to accept that truth. You can believe due to blind faith, or you can believe due to scientific evidence.

  6. This is why you shouldn't tempt fate on Top 10 Ways To Lose Your Data · · Score: 1

    You just know that if that disk HAD been redundant, Murphy's law would have caused a failure on the other disk at the exact moment you pulled the plug.

  7. Re:Build it "by hand" from your prefered distribut on Linux Source Distribution for Firewalls? · · Score: 1

    BTW, there is no reason not to have the developement environment on the system. In fact, I don't see a reason not to make your main desktop system the same as the firewall machine.

    I can see a couple of reasons.

    If someone compromises a normal user account on your firewall, the next thing they will want to do is get root access. They might do this by compromising a daemon running as root.

    Your desktop machine will likely have more potential targets than your firewall.

    Seperating the two means an attacker has to break both your firewall and your desktop machine. Admittedly seperating the two doesn't buy you a lot, as the desktop machine will probably be less secure than the firewall, but it does add a small amount of security, so it's not fair to say there is "no" reason.

    It means that some script kiddie who compromises your firewall through luck rather than skill, doesn't have instant access to all the important data you keep on your desktop machine. Assuming the leet tool they used to compromise your firewall attacks a service that isn't running on your desktop, they could well be stumped.

    Also, your firewall is probably going to be a whole lot more stable than your desktop. If, for example there's someone else in your house using another machine, you'll save them some inconvenience when your desktop box goes down.

    Also, you might be dual booting OSs on your desktop machine. If it's also your firewall, you'll need to configure and keep secure multiple setups rather than one.

    Also, a denial of service attack against your firewall won't stop you using your desktop machine.

    These may not be compelling reasons to seperate your desktop and firewall, but they are still reasons.

    (I have to admit, my firewall and desktop machine are one and the same. :) But still, I can see why there would be some advantage in seperating them, and I would if I had the spare hardware.)

  8. Re:Why? on Praying Doesn't Help · · Score: 1

    But this directly contradicts previous arguments in this thread.

    If God is so concerned about our free will that he won't show his love (because he doesn't want "mindless zombies"), then surely the actions of Morhter Teresa or any other human being cannot be attributed to God. They are the actions of individuals acting of their own free will.

    And it still doesn't answer the question of WHY God would act through proxies rather than wanting to show his love personally, as your experience of love would lead you to expect. Would you ask a friend to tell your wife that you love her? Only if you really couldn't do it yourself. God can do anything himself with 0 effort, as he is infinitely powerful.

    This debate feels a little one sided. :( I don't seem to be getting answers to my points.

  9. Re:Why? on Praying Doesn't Help · · Score: 1

    But this is not a counter-argument to my point. My girlfriend would stop loving me if I refused to show my love for her, because failure to show love is hurtful, and it's hard to love someone who refuses to love you back.

    That does not make her a mindless zombie.

    God would lose nothing if he showed his love for me. I'd still be free to chose not to love him. But I would gain the ability to make an informed choice about my future in the afterlife. If God loved me, he would want that.

  10. Re:Why? on Praying Doesn't Help · · Score: 1

    Oh yes. "God works in mysterious ways". The standard get-out clause for Christian's who have lost an argument.

    God isn't evil. he's just misunderstood.

    When God appears to be good, he's being good. When God appears to be bad, he's not really being bad, we just can't understand the way in which it's good. Nice reality you live in.

    I'm jealous really. I wish that I could see evil and presume that I'm just misunderstanding. Unforunately, that's not a luxury I have.

    But think about this. What if God is really pure infinite evil - maybe you only see good in him because you are incapable of of understanding the infinity of his evilness with your finite mind.

  11. Re:Why? on Praying Doesn't Help · · Score: 1

    Lemmie start off by saying I'd love to have a civilized debate. We have opposite feelings, so we're (more than likely) aren't going to change each other's minds, so lets just give out the arguements without anger.

    Sure, we're in agreement so far. :)

    The one thing he doesn't like (as per the bible) is being tested (which sounds pretty logical for a diety, right?

    I don't think it is at all logical. Being a Christian (or subscriber to another similar religion, I don't think the distinction is important) is a relation of love. God loves us, and wants us to love him. Because I have no other terms of reference, and because God made us in his image, I must assume that this love is broadly very similar to human love (be it the sort of love you feel for a significant other, or love between family members.)

    While it's true that it's not fair to needlessly test love, love is meaningless without expression of that love, and without acting upon that love.

    Would you expect someone to love you if you never made that love known? If you never acted on that love by helping the person you loved, even though it was easily within your power to do so?

    According to Christian philosophy, if I don't accept God I will go to hell, something which by definition is the worst thing that can possibly ever happen to me. God could prevent this. He could do something to demonstrate his love to me. Even without the issue of hell, I would expect that he would want to do this, because that is the nature of love. Given the consequences for me if he doesn't, and the fact that God is infinitely powerful, so the cost to him would be insignificant, it's incomprehensible to me that he would choose not to. So incomprehensible that this behaviour is completely incompatible with my understanding of what love is.

    Again, I ask yourself to put yourself in the position of God. You could save someone you love dearly from an enternity of horrible suffering with little more effort than it takes to blink your eye. Can you honestly say you would do nothing? Imagine your mother is about to be raped and you could save her by snapping your fingers. Would you think "I cannot intervene, becaue if I do, she might only love me because I helped her, but I want her to love me unconditionally". I would argue that if you really loved her, you COULD NOT do nothing.

    God doesn't want to be tested, and yet he is prepared to test me in the cruellest way possible - by ignoring me and do nothing to help me or express his love for my entire lifetime. And the consequences if I fail are the worst they can possibly be.

    Also, another aspect is God is omni- present/potent/etc... and created all and exists everywhere. How can a human, using science (based on man-made theories and such), living in four dimensions be able to prove something that is so far above him exists?

    Why should it not be possible? If God acts in our world, we should see the effects of his action. If we cannot see the effects of his actions, in other words, his actions are impossible to detect, what value are those actions?

  12. Why? on Praying Doesn't Help · · Score: 1

    Why try to apply science to God? Because God is a fundamental influence to many peoples lives. Because people justify their entire moral system on a book written a couple of thousand years ago because they believe it is the word of God. Because people have, and continue to kill each other in God's name.

    People complain that scientists do research which is unrelated to "real peoples lives". Well you don't get much more relevant to real people than this.

    Imagine what a storm this research would have caused in the scientific world if it had been found that prayer DID help people get better.

    It didn't. But still, it's an interesting result. It shows that either:

    1. God doesn't exist.
    2. God does exist, but doesn't listen to calls for help from humans he supposedly loves. This leads me to question how loving/compassionate he really is. If I were God, I would help people, which is one reason I could never be a Christian: I couldn't worship a God I knew was less loving/compassionate than myself.
    3. God does exist and he does listen to people, but not when it could lead to his existence being proved. Again, I'd question the value of a God who is more concerned with blind worship from people than he is with helping the people he loves.

  13. Thankyou on Nokia Investigating Reported Cell Phone Explosions · · Score: 1

    Interesting. The Nokian Gazz has long been the tyre of choice for mountain unicyclists like myself. I always wondered if Nokian was somehow related to Nokia.

    Mystery solved. +1 informative.

  14. Re:TO America: on Distributed Statistical Debugging · · Score: 1

    The value of American liberty lies not in the fact that we value or agree with the KKK, but simply that we allow them to exist on their own ideological merits. The value of the KKK is determined in a free and open manner by a free society, something 98% of the world apparently abhors.

    So, you agree that the US is undemocratic then, and that the constitution is not fairly representing the majority of American's who abhor free speech?

    (For the slow: If only 2% of the world doesn't abhor free speech, even if every single one of those people were in the US, they'd still be a minority as the US has 5% of the worlds population.)

  15. Why the hell would they? on Microsoft Wins Browser War, Abandons 'Innovation' · · Score: 1

    IE is so unbiquitous that most web-designers don't design to the standards, they design to IE, including all it's bugs. That creates barriers to users switching. How many lusers, upon trying out Mozilla and finding their favourite website doesn't render properly are going to assume the fault lies with Mozilla, rather than broken HTML on the website? The vast majority are going to say "Well, it works fine in IE, Mozilla must suck!" If Microsoft were to comply with the standards, it would be easy for users to switch to other browsers. I don't know what the answer is. One solution would be an "Emulate broken IE behaviour" checkbox in Mozilla. But then, that would just allow the bad behaviour of web authors to continue.

  16. Re:Sorry for the confusion... on Bureau of Engraving and Printing Issues New US$20 · · Score: 1
    Sure, it's easy for you. There is, however, a more serious usability issue here. In most countries, every coin and note is distinguishable by touch, and I always presumed this was to allow blind people to differentiate the different denominations.

    So, how do blind American's check that they are handing over a $10 instead of a $100, and how do they check the change they are getting back?

  17. People are so dumb on Oops, Dave Barry Does It Again · · Score: 1

    The biggest stupidity of this whole situation is this: telemarketters want to call people on the do not call list. That means that there are a lot of people out there who have signed up for the list, but STILL buy stuff from companies who phone them.

    Perhaps we should have a voluntary DNC list that has penalities against people who are signed up but continue to reward bad behaviour with their custom. Eventually all the fools would be educated, and the telemarketters would realise their is no point calling people on the list.

  18. IP infringement = theft? Sweet!! on Earthstation 5 Claimed to be Malware · · Score: 1

    Piracy is the same as theft!? Why did no-one tell me before. I've spent ages trying to set up all this P2P crap when I could have been just nicking the CDs from HMV.

  19. Re:It's obviously anti-First Amendment on Analysis Of Symantec's Stance On Censorship · · Score: 1

    I'm not sure if your comments are in response to my comments on going equipped to cause arson, or to the main Slashdot article. Assuming you are replying to me...

    Sadly this law is not unconsitutional, as we in the UK don't have the benefit of a proper constitution.

    I do broadly agree with your comments, it is a poor law, but it is pretty far down the list of UK laws which concern me. I guess this is because I am not aware of any examples of it being misused.

    On the other hand, the Terrorism Act 2000 is being routinely abused by the police in the UK to detain, intimidate and otherwise interfere with people engaging in legitemate, peaceful protest.

  20. Re:Are you suggesting burning rubbish? on Power Plant Fueled By Nut Shells · · Score: 1

    Well, I don't think we are really in much disagreement here. The dioxyns argument does apply against poorly mass burn incinerators, which is the type I've spent time campaigning against. It's certainly possible to make incineration less environmentally damaging, but their are much better alternatives.

    I don't think the plastics argument is a red herring. It's important because energy from waste is promoted as "green" energy, and as a replacement to recycling. But burning plastic is not green, it's even worse (in terms of CO2) than burning fossil fuels, and you didn't present any argument against that. Your argument sounds reasonable, because you say the alternative is to landfil it, but that's not the case. Landfilling is one, poor alternative. The other options are not to use that plastic in the first place, or to reuse or recycle it.

    As you mention, it's entirely possible to remove the plastic before burning. But then, once you start seperating the burnable and non-burnable stuff, you might as well just seperate it for recycling, rather than for burning.

    Good work on the nappies and sanitary towels, BTW. :)

  21. Re:It's obviously anti-First Amendment on Analysis Of Symantec's Stance On Censorship · · Score: 1

    this is like that crime in britain: "going equipped to commit arson". ie, having a lighter in yr pocket.it's all about selective enforcement. ie, the law is interpreted by the police officer.

    It's not all about selective enforcement, it's about intent. A UK court couldn't convict someone in this situation of "going equipped" unless they could convince a jury beyound reasonable doubt that the person intended to use that lighter for arson. With a lighter, this is obviously impossible, as you could come up with a million reasonable excuses for carrying a lighter.

    If you were arrested on suspicion of going equipped, and the only evidence against you was a lighter, you could have very good grounds to sue for wrongful arrest, as carrying a lighter is clearly not evidence of intention to commit arson.

    On the other hand, imagine the police catch a kid going into a school in the middle of the night carrying matches, large amounts of petrol and some molotov cocktails. Imagine further that the person could give no reasonable explanation for why they were taking those items into a school. Here a jury would be much more likely to convict, as a good prosecution might convince them that it was that kids intention to burn down the school. Without the "going equipped" offence, there would be no case to answer, as no actual arson had been committed. The argument in favour of this is that you shouldn't get away with something bad which you had every intention of doing just because the authorities managed to stop you doing it.

    Note, I'm not really defending this law. In fact I disagree with it and a few other similar laws we have (e.g. we also have "going equipped to cause criminal damage"). I'm just pointing out that your interpretation is incorrect.

  22. Wrong! on Low-Cal Diet Extends Life... As Long as You Don't Eat · · Score: 1

    That's exactly what this study does NOT suggest.

    If this result was because flies could only consume a finite amount of food in their lifetime, then the flies which had been starved their entire life would be different from flies who had only been starved for 48 hours. The article quite explicitly says this is not the case - there is no difference between the lifetime dieters and 48hr dieters.

    So how can your claim possibly be true?

  23. I witnessed some hysterrical reporting of QQ47 on Astronomers Upset About Asteroid Panic · · Score: 2, Informative

    Channel 4 news, a fairly mainstream and usually reliable UK news program which was almost unbelievable. The reporter opened the report by saying that an asteroid of such and such a size was going to hit the earth on such and such a date and the consequences were going to be this and that. It was only half way through the report they mentioned that the probability of it hitting was virtually zero, despite earlier saying that is was going to hit us, without any qualification. I can only assume this is exactly the kind of reporting these astronomers are talking about.

  24. Are you suggesting burning rubbish? on Power Plant Fueled By Nut Shells · · Score: 1

    Such "energy from waste" plants do exist and are often touted as "green" energy. There are a couple of problems with this. First, when you burn rubbish, most of the heat generated comes from the plastic in the rubbish. Plastic is ultimately made from fossil fuels, so burning rubbish is just a really innefficient way of burning oil, and does nothing to reduce CO2 emmissions.

    It also produces dioxins and a cocktail of other highly toxic chemicals. There are many studies showing that people who live near waste incinerators are more likely to suffer birth defects, respiratory illnesses and all sorts of other nasties. Filtering systems for incinerators are getting better, but this doesn't really help. What happens to the toxins that are filtered? They are landfilled, or used for road aggregate or material for bricks. This ties the toxins up for a while, but often brings them nearer to people.

    The real solution to household rubbish is to reduce the amount we produce and recycle/compost the rest. If it really turns out that we can't get to a zero waste situation, or it's too expensive, we can use MBT to stabilise the residual waste so it can be safeley landfilled without the toxins leaching out and causing cancer and birth defects.

    Nut shells are of course a different matter to household waste. Generating energy by burning something that grew in one season and would otherwise be thrown away is almost always a winner in terms of CO2 production. If those shells weren't burnt for energy, they would be landfilled where they would rot and release their CO2 anyway, or they would be incinerated,

  25. Dumbing down vs smartening up? on PGP Universal - Usable Email Security? · · Score: 2, Insightful

    There's a constant drive to dumb things dwown, make them easier to use without any kind of understanding about what is going on under the hood.

    This is good in some areas. People need don't need to understand how their word processor or web-browser works. So long as it works, they can use it effectively.

    In the case of information security, it's dangerous. If people use encryption without at least some understanding of security, they won't use it effectively. But they will believe they are safe, because they clicked the "encrypt my e-mail" button.

    Surely the real solution isn't to dumb down the software, it's the smarten up the users. Pretty much everyone who really needs encryption is capable of understanding enough of the issues around computer security and use existing software to secure their e-mail. People need to accept that computer security is a complex thing, and like all complex things, you can't do them without at least a bit of homework.