Slashdot Mirror


User: Onymous+Coward

Onymous+Coward's activity in the archive.

Stories
0
Comments
1,043
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 1,043

  1. Re:Not a chance in hell on Karl Rove's IT Guru Dies In Small Plane Crash · · Score: 1

    The kind of psychology that urges a person to dismiss the potential for conspiracy...

    is the same kind that urges people to bow to authority.

    Please, learn more about the mindset and be better prepared to combat it.

  2. Re:Install Ubuntu on Configuring a Windows PC For a Senior Citizen? · · Score: 1

    Or virus (with a long u), or virora. There being no classically attested usage of the plural of this noun it's hard to know for sure what declension it is.

    Safest, as you suggest, to use an English pluralization of it.

  3. Re:SSL/TLS need more info on Perfect MITM Attacks With No-Check SSL Certs · · Score: 1

    What happens when the private key on that server gets compromised and you need to revoke it (with CRL) and issue a new one?

    Dunno. Can't you also issue a revocation using the cert itself?

    You have to use a secure, preferably offline, method of getting another public key out there again.

    Yes, that's right. There are certain cases where this is perfectly fine.

    It's good you bring up usage scenarios, because all this talk about the effectiveness of methods is entirely dependent on what we're trying to do.

    If I meet some random guy who wants to share some secret information via his website, I should have no trouble accepting a self-signed cert (As long as I am more interested in the secret information than his authorship of it), but I should refuse to accept his CA. Generalized, the idea is that there exists situations where I can trust a person to share information but not to authenticate every website I visit. Analogously, if you give me an account on your system and an SSH server key fingerprint it shouldn't equate to you being able to tell me whether other folks' SSH server keys are correct.

    I don't have a lot of familiarity with SSL certs in particular, but this all seems pretty straightforward to me. Am I missing something? Perhaps everyone is assuming specific usage scenarios. That must account for over half the misunderstandings in discussions about SSL.

  4. another way to authenticate: perspectives on Perfect MITM Attacks With No-Check SSL Certs · · Score: 1

    For the entirety of today I forgot about this project. Only now did I remember after seeing some comments on Reddit.

    Multiple "notaries" who report what key they've seen and when they've seen it.

    Check it out: Perspectives

    You don't even have to replace your oligarchy of trusted companies (keys, rather), you could just use this tool in conjunction.

  5. Re:Don't do this at home on Perfect MITM Attacks With No-Check SSL Certs · · Score: 1

    I JUST EDITED THE CERTS. I changed what they could be used for (from various allowances to nothing at all.) I did not remove them.

    FF 3 series on Windows, FF 2 series on NetBSD.

    I edited the cert trusts for each user, too. Don't forget that it's per-profile.

  6. Re:SSL/TLS need more info on Perfect MITM Attacks With No-Check SSL Certs · · Score: 1

    Doesn't the user then subsequently trust every other signature your CA makes?

    What if they only wanted to trust the one server?

  7. Re:Don't do this at home on Perfect MITM Attacks With No-Check SSL Certs · · Score: 1

    So there's no incentive for me to pay extra for a more competent CA, because their competence (or lack thereof) doesn't really affect anything.

    Any bad certs reduce the value of having a cert. Buying a shoddy cert from a crap company encourages the existence of bad companies and bad certs, thereby reducing the value of your cert.

  8. Re:Don't do this at home on Perfect MITM Attacks With No-Check SSL Certs · · Score: 1

    I just edited the certs. Removed all their authorizations. Haven't tried removing them completely.

    I did this for all USERTRUST, AddTrust, and Comodo certs.

  9. Re:Addtrust, and Comodo. on Perfect MITM Attacks With No-Check SSL Certs · · Score: 1

    Hey, the bogus Mozilla cert I got from StartCom has the following chain of issuers, starting with the cert itself:

    1. CN PositiveSSL CA / O Comodo CA Limited
    2. CN UTN-USERFirst-Hardware / O The USERTRUST Network
    3. CN UTN-USERFirst-Hardware / O The USERTRUST Network

    So PositiveSSL's cert was issued by USERTRUST, and USERTRUST's cert was issued by USERTRUST. I don't see AddTrust in the loop.

    Here's the bogus cert that I saw.

  10. Re:Addtrust, and Comodo. on Perfect MITM Attacks With No-Check SSL Certs · · Score: 1

    Well, there's some acquired liability...

    Now that I know Comodo is responsible for at least some of the certs coming from the AddTrust key, I'm disabling AddTrust and Comodo.

  11. Re:And? on Barack Obama Is One Step Closer To Being President · · Score: 1

    I see.

    So I'm saying we need to work hard together to institute some kind of Preference Voting.

    Sadly, the highest profile advocacy group, FairVote, seems stuck on IRV. Not the best system, but, hey, it still beats Plurality.

  12. Re:And? on Barack Obama Is One Step Closer To Being President · · Score: 1

    I imagine it's very unlikely that I'll be able to convince you of the practical need for strategic voting, but let's give it a try. Here's a metaphorical race meant to illustrate, if extremely, the impact of conscience voting in a plurality system:

    Your group of 100 people gets to choose a dessert, which you then must eat:

    • ice cream (<--- your favorite (mine, too!))
    • brussel sprouts
    • soap

    Before folks cast their ballots a straw poll reveals, dismayingly, nearly even odds between sprouts and soap.

    I would vote for brussel sprouts rather than have to eat frickin' soap.

    We've been eating soap for the last 8 years. Idealistic conscience voting helped us to waste $567 billion tax dollars in Iraq. So far. And the list of how this administration has been poison for our country only starts there.

    Anyway, the matter becomes moot if we can institute a system where we can rank our preferences. We should focus on that.

  13. Re:And? on Barack Obama Is One Step Closer To Being President · · Score: 1

    Ah. That's a rationale behind vote spoiling that I'd never heard before.

  14. Re:And? on Barack Obama Is One Step Closer To Being President · · Score: 1

    Not sure what you're trying to say there. Maybe that you weren't in a swing state? (You voted in Tennessee and Arkansas?)

    In that scenario you can vote your conscience, sure. Sadly, people also do it in swing states.

  15. Re:And? on Barack Obama Is One Step Closer To Being President · · Score: 1

    When you gamble that way you lose the delta between candidates. When George W. Bush is a candidate, the delta is huge. Feelin' it? Sucks pretty bad.

    How about you game the vote like everyone else, but push for vote reform so that no one will have to?

  16. Re:And? on Barack Obama Is One Step Closer To Being President · · Score: 1

    Picking a good candidate without a viable chance of winning is a stupid ideological stance in an ultimately practical situation. It's not a nice choice (to actually cast a vote for), it's delusional.

    You'd figure that someone like this would be supremely interested in procedure, like understanding the merits of instituting a preference voting system over the third-party-quashing plurality system we've got.

  17. Re:NoScript plugin in firefox on Experts Say To Switch Browsers In Light of IE Vulnerability · · Score: 1

    Yeah, I use NoScript too, but something about your post seems creepy.

  18. Re:In other news ... on Experts Say To Switch Browsers In Light of IE Vulnerability · · Score: 1

    Oh, wow, I totally forgot about that "refocus on security" thing.

  19. Re:Spycraft: The Great Game on Torture in Games · · Score: 2, Interesting

    Which is great for those of us with adequately working prosocial wiring in our heads, which most of us have. I think it's a great way to help make the horrible actuality a little more real than the glossed-over, glamorous version we get programmed into us from Hollywood.

    But there are those of us who have our wiring messed up. I don't know what the frequency is, and in net forums the tendency to mouth off creates a disproportionate appearance, but I imagine there are enough out there that it deserves societal effort to rectify. If you've ever been bullied by a real (chronic) bully, you know that that kind of behavior needs fixing for the whole of society to be healthier. This kind of wiring responds positively to the suffering of others, so the stark horror of torture wouldn't necessarily be the ethically edifying experience one would hope for.

    But I'm not contradicting myself — I say put torture in video games, have the majority of us get a better grip on the awfulness. Giving bullies virtual persons to antagonize might settle them a little further into their ruts, but they should be addressed more from a causal perspective — how'd they get that way in the first place? The benefit of enlightening the greater majority I think outweighs the harm in further solidifying already durable bullying tendencies.

  20. Re:One area where open source will definitely win on Open Source Program Reveals Diebold Bug · · Score: 1
  21. "How about having it printed on acid-free paper?" on Long-Term Personal Data Storage? · · Score: 1

    Hm.

    Printed at a modest 750 DPI, with a half-inch border... ((7.5*10)in * (750 DPI)) =~ 4.22 M dots.

    5.27 Mebibytes / sheet, conservatively single-sided

    2.52 Gibibytes per ream (500 sheets)

    If you move up to 1200 DPI, and if your toner or ink won't cling between sheets you can use both sides: 12.9 Gpr.

    Printer drum will last 20,000 normal pages, but let's say 1,000 50%-full (i.e., data) pages. Drums (or printers themselves) are around $100. Thus $50 / ream.

    Cartridge will last 9,000 normal pages, and say 450 data pages. Cartridges perhaps around $75. Thus $80 / ream.

    Acid-free paper 500 sheets (20 lbs.) ... USD$5.

    So...

    About ten bucks a gig for simple storage that'll last 500 to 1,000 years.

    Good idea.

  22. Re:Again, Quality DVDs on Long-Term Personal Data Storage? · · Score: 1

    I saw this recently on some Wikipedia editor's profile:

    The plural of anecdote is confirmation bias.

  23. Re:won't somebody think of the mornings? on Waste Coffee Grounds Offer New Source of Biodiesel · · Score: 1

    Nothing alone is going to replace this magical black liquid made from millions of years of compressing carbons into a very energy dense medium.

    Actually, algal biodiesel could do it even at current rates of per square foot production.

    This is the area required to do so at current production efficiency (about a seventh of the land being used for corn production). And marginal lands can be used. Think about that. And production can use ocean water and wastewater — it doesn't require fresh water. And the process can get part of its input by filtering out CO2 from power plant exhaust.

    Algal fuel is something to look into.

  24. Re:A Happy ending on Followup To "When Teachers Are Obstacles To Linux" · · Score: 1

    > Helios was perfectly in the right to flame back

    Well, depends on what you mean by "in the right".

    Some people don't subscribe to the "eye for an eye is fair" model from an intellectual standpoint, though it's totally understandable as an emotional reaction, if that's what you mean.

    If by "in the right" you mean "it was the right thing to do to make the situation better", that's plainly wrong.

    Let's not confuse emotional response with helping out.

    But you're right that he still did a pretty good job of keeping his temper in check to otherwise do right by her.

  25. I wonder of TFA is informative... on Examining the Beginnings of the RTS Genre · · Score: 1

    Didn't RTFA for some reason... I think I got caught up in the comments here. I had to put this together from what I learned from the comments:

    More information on RTS history at WP.