Slashdot Mirror


User: WaffleMonster

WaffleMonster's activity in the archive.

Stories
0
Comments
4,185
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 4,185

  1. Section 215 red herrings on FISA Court Extends Section 215 Bulk Surveillance For 90 Days · · Score: 2

    Recipient and contents of application:

    (1) shall be made toâ"
      (A) a judge of the court established by section 1803 (a) of this title; or

      (B) a United States Magistrate Judge under chapter 43 of title 28, who is publicly designated by the Chief Justice of the United States to have the power to hear applications and grant orders for the production of tangible things under this section on behalf of a judge of that court; and

      (2) shall includeâ"
      (A) a statement of facts showing that there are reasonable grounds to believe that the tangible things sought are relevant to an authorized investigation ...

    What "authorized investigation" can possibly necessitate COLLECTION of EVERYONES phone records?

    If you can't answer the question then don't spew bullshit about section 215 red herrings.

  2. Number of players 0 on US Treasury Dept: Banks Should Block Tor Nodes · · Score: 1

    Sometimes it is better to live with risk which at least offers some useful feedback.

    Going forward with a token reaction sure to be trivially countered in short order very likely will also carry side effect of reducing your ability to detect future fraudulent activity.

    If not Tor it will be a botnet if not a botnet it will come from some rinky dink VPS.

    Much better to invest in technological solutions to address root cause such as distribution of hardware keys less susceptible to electronic theft.

  3. Re:Sounds good to me on The Cost of the "S" In HTTPS · · Score: 2

    You need both at the same time to make a session that is MITM resistant.

    Over the years I've run into more than a few people who think this. I don't know quite where the meme comes from yet I suspect it to be based on incorrect assumptions about how the technology actually operates.

    If you are making a judgment the whole house of cards of hundreds of global CA is not worthy of your trust that is quite a reasonable and understandable position..

    If you are saying the user will just click "continue" when they get a scary certificate warning this is also quite a reasonable and understandable position..

    Otherwise barring any publically undisclosed problems MITM is prevented by proper validation the chain of trust from roots installed with your browser all the way to the servers public key matched with corresponding DNS name, key usage and expiry.

    You can't MITM without defeating security of the technology or hacking CA and or Server.

    If you doubt or disagree please provide specific technical means by which MITM can still occur.

  4. Re:Sounds good to me on The Cost of the "S" In HTTPS · · Score: 1

    The user/pass is in place of the cert. Client certs is a pain

    It does not have to be a pain like setting up any new account there is a an unavoidable step of establishing initial business/trust relationship.

    Whether it is showing up in person with evidence of identity or creating a new online account anonymously the best place to push or hand out client certs is here.

    you need to not only store all of them, but you need to validate they're signed by a CA, also meaning each user needs to purchase a cert from a recognized CA.

    In my view it is unnecessary and dangerous to farm this out to a third party. As the server you are the one granting access to your application so you are best positioned to operate as your own CA and either sign CSRs your customers bring you or hand out key-pairs to your customers. Unlike browser cert stores servers have full control over CA's they are willing to trust.

    If you push a .p12 file most browsers will ask you if you want to install the client cert, say yes and that's it. It only makes sense to push as part of an initial online signup step otherwise distributing certificate "in band" even with CSRs stands a chance of at least partially defeating the point of client certs in the first place.

    A cert is just a way to authenticate and has no bearing on the encryption.

    Encryption without trust (authentication) is meaningless. In TLS authentication is bound to derivation of session encryption.

    Personally I think a much more practical solution for many uses is to get browser vendors to commit the TLS-SRP patches collecting dust in their ticketing systems. If they did that we can use simple login/password to establish secure mutually authenticated sessions by way of zero knowledge proof without f**king around with certificates at all.

  5. Re:Sounds good to me on The Cost of the "S" In HTTPS · · Score: 1

    It's not at all impossible if the client doesn't have a client cert. TLS is just plain broken if you don't use client certs, and normal website browsing doesn't use client certs. So HTTPS is just plain broken.

    Client certs operate the same as server certs. Only difference they establish trust in the reverse direction authenticating client to server.

    Whatever you think makes server certs "just plain broken" is also possible with client certs.

  6. IoT = Internet of Trolls on IoT Is the Third Big Technology 'Wave' In the Last 50 Years, Says Harvard · · Score: 1

    The things that need sensors to operate properly and or safely already have them.

    Things that don't at best stand to benefit only marginally and at questionable ROI to their users.

    The only point of salivating over IoT is selling gimmicks and excuses to spy on everyone and everything for profit. To quote TFA "and after-sale service and by creating the need for new activities such as product data analytics and security."

    How does the customer benefit from that? They don't... was never the point.

  7. Putting electric vechicles to work on You're Doing It All Wrong: Solar Panels Should Face West, Not South · · Score: 1

    From PG&E's website during summer low demand is 0.143/kWh, high demand 0.336/kWh cents... About 20 cent/kWh differential.

    With EV batteries into the 100 kWh range in our not so distant future and talk of breaking $100/kWh storage barrier market incentives to disruptively break-thru with cost effective buffering seems to be plausible in the short to medium term.

    Solar panels last 20 years...

  8. Re:Bit torrent in dire need of fixing on Music Publishers Sue Cox Communications Over Piracy · · Score: 1

    You cannot have Bittorrent work (distributing files to anyone who wants to get them) while blocking the bad guys from participating because the bad guys can be anyone.

    Solving the problem does not require limiting participation. Solving the problem requires limiting **knowledge** of activities of other participants. It is possible to limit discoverability of intent of individual participants in the same way Tor limits discoverability of identity. The only requirement is having significantly more good actors than bad actors in the system.

    Alternatively, you can't have Bittorrent be efficient (fast) if you plug it full of fake data.

    I don't imagine any such activity would necessarily require much overhead. Just enough to generate doubt and plausible deniability.

    The ONLY way to solve it is as I have stated. This is how the internet works. It's the fundamental design of the thing.

    The Internet is just a means of conveying packets of information between peers with some certainty of delivery. You can build any structure you want on top of it including a separate overlay network there are no inherit limits.

    For example if access in bit torrent were on a random basis resolved by indirect requests on behalf of others nobody could be sure of original intent of any requestor only they would know if they are the ultimate consumers. The same onion routing techniques that make tor work can be leveraged to fix bit torrent.

  9. Re:Bit torrent in dire need of fixing on Music Publishers Sue Cox Communications Over Piracy · · Score: 1

    Every single packet touching a major ISP is logged and tracked by the government.

    While we should assume as much this type of information is out of reach of MPAA. Sniffing transport isn't the problem and isn't how MPAA is gathering their data for infringement notices.

    The problem is anyone on bit torrent network is able to infer activity of many many many other people just by normal participation in the bit torrent protocol.

    Access to room 641A *not required*.

    If you want SECURE communication establish the security OFFLINE. You CANNOT trust the channel.

    Secure communication is not really the point in this context... exchange between peers just needs to be facilitated differently so there is less global visibility and perhaps some spoofing/red herring activity to lower credibility of any data collected.

    I understand there is inherent risk in the proposition ... fundamentally asking the kinds of questions bit torrent clients ask requires some measure of discoverability and associated risk of detection yet there is much room for improvement left on the table.

    Tor network while not perfect is able to afford users some privacy -- it can be done and does not need to be perfect.

  10. Bit torrent in dire need of fixing on Music Publishers Sue Cox Communications Over Piracy · · Score: 1

    Problem is any actor with money who wants it is able to extract a more or less complete picture of activity occurring on bit torrent.

    The system as it exists today is simply too open and too transparent creating a lightning rod from intelligence being wielded to justify all manner of legislative unpleasantries.

    If exposure issues are not fixed in bit torrent eventually we will see legislative reality that harms everyone more than any illegal activity.

  11. Re:Remarkably little lens flare. on First Star War Episode 7 Trailer Released · · Score: 1

    That's why it's a teaser. Haven't you heard of bait and switch before?

    Still reeling from the last air bender previews where nothing from the preview was present in the movie. For over a year I wanted to see it and when I finally did I wish I hadn't.

  12. Re:Why is Android allowing Uber to access the info on Uber's Android App Caught Reporting Data Back Without Permission · · Score: 1

    So yes, you're right. No app should be able to take your personal information without your consent. That isn't what's happening. The problem is that you're giving them your consent by using the software, you're just too lazy and ignorant to bother actually reading the legal terms, to take the five seconds or so it takes to scan the list of capabilities and permissions the app supposedly "requires" to run.

    The text from TFA is as follows: "and your SMS and MMS logs, which it explicitly doesn't have permission to do."

    What permission in the list of permissions asserted in the manifest grants SMS and MMS log access? Does it access your google account and download data from a backup? How is it doing it? Name the permission which enables this activity.

    You hand the stuff over to them, you have nobody to blame but yourself. You certainly can't blame Android for "allowing" it because it doesn't "allow" it unless you EXPLICITLY ALLOW IT YOURSELF.

    I'm not down with blaming the victim when a platform has been intentionally engineered to fuck over users.

    The Uber app isn't a virus, it doesn't install itself through some unpatched exploit.

    If facts asserted by TFA are correct it is spyware.

    You get what you deserve. Truth hurts, I know, but blaming Android for your own, personal failings and naievety makes you look really fucking stupid.

    Would love to know which permission explicitly grants SMS access.

  13. Re:It DOES have permission on Uber's Android App Caught Reporting Data Back Without Permission · · Score: 2

    I just went to the google play store page for Uber, and checked the permissions the app requires. It includes:

    Read your Contacts, take pictures, status and identity, modify system settings, read google service configuration, and a host of others.

    So, based on this (admittedly limited) information, it doesn't seem to be bypassing google security so much as utilizing the proper channels to claim superior access to the user's phone.

    What I don't understand is the SMS claim. Is Uber exploiting a vulnerability to get SMS data or do these other permissions somehow grant some kind of access to SMS as well?

    There is a whole group of SMS privileges and according to the app store not a single one is being claimed... so what gives?

  14. Outlawing plea deals should be a national priority on Hacker Threatened With 44 Felony Charges Escapes With Misdemeanor · · Score: 2

    When the word plea bargain is spoken all I hear is "forced confession" in keeping with traditions of the worlds leading jailor the United States of North Korea.

    People should simply be charged with whatever the crime they are accused of committing... It just isn't the act of using coercion to force a desired outcome alone it is all the second order effects this practice asserts on the whole system turning everything to shit.

    Maximum sentences are allowed to pierce the stratosphere because nobody notices when insane sentences are merely threatened but not actually handed out.

    Laws are intentionally written in broad terms to be used as a weapon yet again nobody cares because it does not happen.

    And before you know it in all ways that matter we are back to kings jailing the peasant fools they happen to dislike.

  15. Re:Empty article.. on How Intel and Micron May Finally Kill the Hard Disk Drive · · Score: 2

    Also incorrect assertion that drives don't go faster than 7200

    Also premise from SSD article spindle speed is a limiting factor is a bogus oversimplification.

    Density increases have always translated to correspondingly higher I/O rates at same rotational speeds.

  16. Re:Be Gentle With Him on The Schizophrenic Programmer Who Built an OS To Talk To God · · Score: 4, Insightful

    your "good guy" is a racist.

    Continually find myself entertained by self appointed judges... many of whom claim to worship at the church of tolerance.

  17. Re: Pathetic on Officer Not Charged In Michael Brown Shooting · · Score: 1

    You seem to know more about what took place than the grand jury? Care to share your sources?

    CNN

  18. Why I hate CNN on Officer Not Charged In Michael Brown Shooting · · Score: 1

    News media are nothing more than trolls pushing peoples buttons to whore attention and viewership. They race bait constantly and bark like rabid dogs whenever someone calls them on rampant hyperbole and worthless mental masturbation invoked to kill time in the absence of any actual news or evidence.

    First thing out the gate today after announcement was Mr Tooooobin getting all hot and defensive about Bob calling out misleading bullshit coming from the media.

    The equation seems to be keep the masses divided by stoking tribalism while systemic issues and gross injustices ... stop and frisk, racial profiling, quotas/revenue generation, plea deals, minimum sentences, prosecutor incentives divorced from truth seeking, war on drugs, existence of unenforceable laws and general systemic failure to counter human tendency to abuse power that comes with badge and gun go largely ignored and unaddressed.

    The media always hides behind the notion they are just reporting or that tribalism is a valid topic. This is bullshit. They get to choose what they go all MH370 on and what they remain silent about. Their decisions very much affects reality and are very much determined by their pursuit of attention... they are professional trolls.

  19. Re:Better go kick WSUS into a sync... on Microsoft Releases Out-of-Band Security Patch For Windows · · Score: 1

    I don't know what the deal is, but it looks like maybe Microsoft stopped testing security patches on August's patch tuesday, or something.

    Having recently "downsized" their QA staff testing work has been outsourced to paying customers.

    When they say they will release a patch 10 AM PST this represents the time they will have managed to get it to compile.

  20. Google APIs on Google Wallet API For Digital Goods Will Be Retired On March 2, 2015 · · Score: 1

    Here yesterday, gone today.

  21. Re:Stop trying to host it yourself. on Ask Slashdot: How To Unblock Email From My Comcast-Hosted Server? · · Score: 1

    Stop trying to host everything yourself. Unless you are a defense contractor or otherwise dealing with extremely sensitive data there is no reason in the year 2014 to run your own mail server.

    There is no reason in the year 2014 everyone who wants to should not easily be able to host their own mail servers. None of this is or should be rocket science.

    The underlying problem is that SMTP email constitutes the most costly and disastrous failure of any Internet RFC in the history of the world. It needs to be replaced.

    I get that you want to. Just stop.

    The Internet was never intended to be a network of spectators.

    Google is a great provider, has competitive pricing, and great reliability. Their competitors are worth looking at as well.

    Google reads your email... not so "great" in my book. The rest are subject to "any tangible thing" / third party doctrine intrusions here in the US... not interested.

  22. You lost me at on Carmakers Promise Not To Abuse Drivers' Privacy · · Score: 2

    that the information that their cars stream back to automakers or that is downloaded from the vehicle's computers won't be handed over to authorities without a court order

    This is the problem. Record everything and everything becomes discoverable. There is no distance from the man himself standing over your shoulder noting everything you do and everywhere you go.

    Use cases for recording all this data are equally pathetic...

    "The technology uses a radio signal to continually transmit a vehicle's position, heading, speed and other information. Similarly equipped cars and trucks would receive the same information, and their computers would alert drivers to an impending collision."

    If you feel compelled to make drivers safer with computer generated warnings then do so based on observations of the world as it already is. While image/sensor processing is more difficult computationally than recording transmitted signals the supporting hardware costs nothing and software R&D costs maximally benefit from deployment at scale and general interest in image processing across a growing number of domains.

    Plus you get capabilities transmitters do not provide such as the ability to react to vehicles or obstructions not transmitting their positions.

    "As modern cars not only share the road but will in the not too distant future communicate with one another, vigilance over the privacy of our customers and the security of vehicle systems is an imperative," said John Bozzella, president of Global Automakers, an industry trade association."

    Security of vehicle systems will never happen because we have proven ourselves incapable of ever producing a secure anything. There is also a small minor problem of owners of these vehicles themselves not being trustworthy.

    Sensors which view the world as it actually is rather than blind assertions of transmitters you have no reason to trust is both more secure and more useful on the context of driving vehicles on paved roads.

    The automakers' principles leave open the possibility of deals with advertisers who want to target motorists based on their location and other personal data, but only if customers agree ahead of time that they want to receive such information, industry officials said in a briefing with reporters.

    Where have I heard this before? You agree as a condition of purchase or in some fine print most people will never read. Everyone knows the drill by now.

    "You just don't want your car spying on you," he said. "That's the practical consequence of a lot of the new technologies that are being built into cars."

    Pure bullshit this isn't about technology, the future or in any way leveraging technology to provide additional value to consumers. It is about leveraging technology to provide additional value to manufacturers and their value chain.

    You don't need to report your location to view a map of your location. You don't need to report your location to download traffic conditions. You don't need to report your location to calculate the distance to nearest charging stations. You don't need to report your location for safety reasons.

    You only need to report your location so others can profit.

  23. Regulation to the rescue on President Obama Backs Regulation of Broadband As a Utility · · Score: 3, Interesting

    Would much rather see legislation focus on promoting last mile fiber infrastructure any ISP can compete to light up on a fair and equal basis.

    That Net neutrality is even an issue is a symptom of larger problem of market failure. As long as the only viable ISP in town is a national cable company you can legislate till your blue in the face customers are still going to get fucked over as long as there remains no serious alternative.

  24. Re:Microsoft? on Ask Slashdot: Choosing a Data Warehouse Server System? · · Score: 3, Informative

    MSSQL?

    why would anyone in their right mind go with MICROSOFT for a company database ? specially a big data database ?

    I will not claim any "big data" experience.

    At least you have an opinion informed by no experience.

  25. Atomic hand warmers on Buying Goods To Make Nuclear Weapons On eBay, Alibaba, and Other Platforms · · Score: 1

    While we all love our polonium encrusted static master brushes, americium drenched smoke detectors, tritium and radium enhanced time pieces... what I really want for Christmas this year are a matching pair of plutonium powered hand-warmers.

    None of this boiling water to recharge leaky sodium acetate bags made by the lowest bidder, intentionally throwing our smartphones into thermal overload or the mess left behind by paper envelopes filled with iron filings.

    Not only do plutonium hand warmers guarantee many years of gentle continuous warmth none of your friends will hassle you to borrow them.