Slashdot Mirror


User: cbhacking

cbhacking's activity in the archive.

Stories
0
Comments
4,314
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 4,314

  1. Re:Not to worry on PSA: Pokemon Go Has Full Access To Your Google Account Data (techcrunch.com) · · Score: 2

    Well, the app has to request that you sign in to grant it access, and you have to do that. It can't *just* assign the permissions to itself; you do have to do something too.

    With that said, I certainly *thought* that Google would tell you just what permissions it is granting to what entity (app, in this case) and require you to approve that grant before actually giving access. Apparently that's not always how it happens, though (at least, not for ex-Alphabet companies, or something).

  2. All fun and games until your account gets stolen. on PSA: Pokemon Go Has Full Access To Your Google Account Data (techcrunch.com) · · Score: 4, Interesting

    Do you use your Gmail address with any services other than Slashdot? At a minimum, just having your /. account tied to your Gmail account means that they could reset your /. password and take over your account. If you have any other third-party accounts tied to that Gmail address, they can be compromised too.

    In the modern world, there are few things that need to be more tightly protected than your email account (which is sad, considering the pathetic state of email security). It's the key to getting into far too many other things.

    Additionally, something like this could be used to spam all your contacts with messages (possibly containing malware, or at least malicious links) that appear to come from you. I figure it's been long enough since ILOVEYOU for people to have forgotten some of the more salient lessons there; I'm seeing an uptick in advertisements for scam sites being spread that way on social media.

  3. Nitpick: BE-4, I believe, the new (in development) methane/LOX engine. BE-3 is efficient enough to make sense as an upper-stage engine but is probably unsuitable for some other reason.

  4. You realize that traffic fatalities are a multiple-times-daily occurrence in the USA alone, right? That's not some fuzzy guesstimate, it's about as statically sound as you could hope for. 94M miles (the number Tesla gives per fatal accident in the US, which is a better comparison than the idiot submitter and CNBC author chose to display) is nothing in a country with over 2.5 times that many vehicles. The worldwide rate is, if anything, possibly less well-established just because it's hard to collect accurate global statistics, though I'm sure that it's a damn solid number in the data they have.

    True, this is the first fatal Tesla crash while under autopilot, so we don't have enough data yet to draw a trendline, but it's just as likely that this was a fluke in happening after *only* 130M miles. We also don't have (or at least, weren't given) the rate for luxury sports car drivers in the US, but I wouldn't necessarily expect it to be that much safer than the general populace except possibly as a result of the cars themselves having better safety standards.

  5. He didn't need to buy that; Russia would have done it for anybody that put their finger in the US government's eye so thoroughly. Especially after said government tried to launch a smear campaign against the guy in an apparently-not-totally hopeless attempt to dupe some people into believing (among other baseless claims) that Snowden was in it for personal gain... At that point, it's a chance for Russia to laugh in the face of the US and call its government's lies out for what they are, by protecting the person the lies were about.

    Or you could be charitable to the Russians, and suggest that they were just doing the right thing, harboring somebody who did the right thing, and the courageous thing, and was hunted by his own government for it. Russia certainly has the history to understand the injustice of political prisoners, ironic though it is for the US to be the nation producing them.

    Or hell, maybe Snowden just gave them a pile of (legitimately-obtained) cash and/or the information on some wanted criminals (wanted for real, harmful crimes, not for political dissent) that the NSA had located within Russia but not shared with the Russian government. Simple motivated self-interest, neither focused on Snowden's actions nor on the US government's actions. I doubt this theory, but it's plausible.

    In any case, do you have any actual *evidence* that Snowden sold his data to any foreign powers? Because there's lots of reasons he could have found asylum in Russia.

  6. Re:Pardon for what? on President Obama Should Pardon Edward Snowden Before Leaving Office (theverge.com) · · Score: 1

    Considering that the breakdown along age demographics was far stronger than along education levels, with the strongest "remain" supporters in the youngest age group (many of whom are working on, but do not yet have, a degree), calling 43% "a large percentage" is even more disingenuous than it appears. Old people earned degrees, too. I'd expect them to have grown up with the stories of how nationalism and xenophobia led to the most horrific war in in the modern world, but maybe they forgot in the last more-than-a-half-century of European peace.

    Idiots. Yes, even the ones with degrees.

  7. Re:Then the tech company becomes non-US on Non-US Encryption Is 'Theoretical', Claims CIA Chief In Backdoor Debate (theregister.co.uk) · · Score: 1

    Redmond is well over 60 miles from the border - more like 120, and more if you want to get into Vancouver proper - but your point stands. They'd lose out tremendously if they had to avoid selling to the US too, but quite possibly less than they'd lose out if nobody *but* the US would buy backdoored products.

  8. Re:Considering how much on Non-US Encryption Is 'Theoretical', Claims CIA Chief In Backdoor Debate (theregister.co.uk) · · Score: 1

    While that's a tempting view to hold... Apple encrypts their iOS devices with crypto the government cannot easily, if at all, break (the San Bernadino shooter's phone, which kept them flummoxed for a while, was an old model and improvements have been made since then). Apple also recently announced changes to their app SDK that basically means your servers *must* use good TLS, unless you want to apply for exceptions for every unsecured connection your app wants to make. Microsoft has been making BitLocker available in more and more devices, and as far as I know the government has no way to break that either (unless you let Win10 upload your recovery key to Microsoft, which is not the most trustworthy move on their part but can be avoided). Google has been pushing encryption on their devices as well, and between their data centers, and in their browser. Amazon temporarily dropped encryption on Kindle Fire devices, but then restored it. Not sure what Cisco/Juniper/F5 would have to say (and they've sometimes been the bottleneck on crypto (TLS) advances on the Internet, though I think that's more out of laziness and lack of quality than anything else), but they've got to compete with the likes of Huawei and aren't going to want the government to do anything that makes them look even less trustworthy than those folks. I wouldn't trust anything out of Oracle even if they just said the sky was blue, but I doubt it's actually in their best interest to have backdoored crypto either. In other words, there are plenty of tech companies that are demonstrably fighting against this bullshit.

    Of course, at some level all those companies rely on other organizations (hardware manufacturers, certificate authorities, compiler providers, all the way up to the people who pick cryptographic primitives to support and identify the parameters that are best to use with them) to make it possible to build a backdoor-less crypto system. Remember Dual_EC_DRBG, and how the NSA bribed RSA Security to make it the default? How about "Reflections on Trusting Trust" (PDF link)?

  9. While I get what you are trying to say... that is so, so wrong that I realllllly hope you are nowhere near any crypto code, in either your professional or personal hours.

    Getting the basics of a crypto function right is easy. The algorithms, complete with pseudocode or even a basic implementation in some real language, are well-published. As you say, anybody with halfway-decent skill can implement them from specifications.

    Getting the details of a crypto library write is really bloody hard! There's always a risk of incorrect behavior in some edge case that completely breaks your system, for example - Heartbleed was probably the most famous and easiest-to-understand of these, but there's plenty of others across many libraries - but risks like that are not unique to crypto libs (although they are usually *worse* in a crypto lib). Side-channel attacks like timing attacks, padding oracles, CPU cache line attacks (technically a kind of timing attack, but not the sort most people think of when you say "timing attack"), and many more things than I know about bedevil implementations of such things.

    Just like nobody but an expert in crypto theory should ever attempt to design their own crypto algorithm, nobody but an expert in crypto implementation should ever attempt to write a cryptosystem in live code. If you think "anyone with halfway-decent coding ability can implement them from the specs and get an encryption library with no backdoor", then there is ~0% chance that you could implement a crypto library and get one that cannot be broken, at which point who cares if it has a backdoor explicitly built in?

  10. Re:Kinda sounds like how a LASER works on Finnish Scientist Provides Another Explanation For The 'Impossible' EM Drive (examiner.com) · · Score: 1

    Yeah... except that even a perfectly-efficient microwave-frequency laser would produce much less than 1% the observed thrust of the EmDrive, at the power levels that have been used in testing it. Either our understanding of photon momentum is completely wrong (which seems unlikely, since we can directly observe the thrust from photon drives) by roughly three orders of magnitude, or the measured thrust is completely wrong (which gets less plausible with every replication, though it's still a leading theory), or the EmDrive is doing something that produces a lot more thrust than merely spitting microwave photons out its ass.

    If photon drives could produce meaningful thrust at usable power levels, we'd already be using lasers or parabolic reflectors - whichever turned out to be more efficient in terms of thrust-to-mass ratio - to drive our satellites. The principle has been known for a long time. We aren't doing that, because the thrust produced is unusably tiny for the power levels a spacecraft has available. The EmDrive's observed thrust-per-energy ratio would be much more usable, especially if we could refine the design to be more efficient. Remember, with the EmDrive we're working from observations and trying to build a model; until we have the correct model we won't know the maximum efficiency. For photon drives, we're working with models and verifying them in the lab; the maximum efficiency is already well-known.

  11. Re:If this is correct it should be easy to check on Finnish Scientist Provides Another Explanation For The 'Impossible' EM Drive (examiner.com) · · Score: 2

    The bigger problem is the question of trust-to-power ratio. Specifically, the fact that the EMDrive exhibits way too much thrust-to-power to be a photon drive unless the photons are *way* more energetic than microwave photons. The momentum of a photon is a function of the photon's frequency (or, inversely, wavelength), and the momentum is also proportional to the energy. This means it's pretty easy to compute the maximum possible force from a given frequency of EM radiation at a given power level (assuming perfect focus and zero losses, which are of course unrealistic); take the energy per second (power), divide by the energy per photon (determined by frequency), multiply by magnitude of the momentum vector per photon (determined by frequency, and remember we're assuming all photons are perfectly focused out the back so the direction of the momentum vector is built into our assumptions) and get the total impulse per second (which is force). The EMDrive produces about three orders of magnitude too much force to be a pure photon drive; at the energy levels used in EmDrive tests so far, a photon drive's thrust would be completely undetectable to the test apparatus.

  12. Re:Telemetry on SpaceX's Falcon 9 Crashes Into Droneship (cbsnews.com) · · Score: 2

    That's for single-engine landings, when they have more than a trivial amount of fuel left and can afford the time to land gently. That really only works for launches to low earth orbit (LEO).

    Geosynchronous Transfer Orbit (GTO) or Super-Synchronous Orbit (SSO) launches are another matter entirely. Those use very nearly all the first stage's fuel, and go extremely fast. The rocket doesn't have enough fuel to "boost back" the way it does for LEO landings, so the droneship needs to be much further out to sea. More relevantly here, though, the rocket doesn't have enough fuel to make a (relatively) long minimum-thrust burn on one engine. Instead, it runs three engines (at an unknown throttle level, but possibly a fairly high one) for mere moments, to kill its velocity as quickly as possible (this exerts about 12G on the rocket, much more than it takes at any other part of the flight). This actually requires less fuel than the single-engine burn, because of gravity losses. The entire time the engine(s) are firing, a portion of their produced thrust is wasted countering gravity; a shorter burn means less time spent in the gravity-fighting range between terminal velocity and touchdown.

    This launch was to SSO, and carrying two satellites at once to boot. The rocket was coming down extremely fast. Even if it wasn't running those three engines at max - and it may well have been doing so - there probably wasn't time to throttle other engines up in response to one engine underperforming. The entire maneuver is over in a few seconds, and at that kind of acceleration (12G!!) every fraction of a second counts.

  13. Re:What's to stop people sending fake pictures? on Online Loans Made In China Using Nude Pictures As Collateral · · Score: 1

    My office has no floor numbered 13. It's not a new building, but it's not ancient either (practically nothing in Seattle is, although this building is probably older than most of them).

  14. Re: SpaceX's Next Big Challenge on SpaceX Successfully Lands Its Rocket On A Floating Drone Ship Again (theverge.com) · · Score: 3, Interesting

    SpaceX is a big player indeed. Take a look at http://spaceflightnow.com/laun..., and you'll see that SpaceX is right up there in launches scheduled. It's even competitive with Soyuz. That's with Falcon Heavy not online yet, too; they'll be able to pick up even more jobs once they can put heavy and even super-heavy-class payloads up. For that matter, they may not even need FH for that; according to their latest payload limit updates, the F9 is a Heavy-Lift Launch Vehicle (more than 20 tons to LEO) if flown in expendable configuration (no legs, no fins, probably little if any first-stage RCS, and no need to conserve fuel for re-entry and landing). They can't re-use those boosters, but they can use the profit margin on them to focus on making reusable launches even cheaper and faster.

    As for mass market, though, that's a case where SpaceX's success will feed on itself. Right now, satellites are super expensive to launch. This means that you want to make the ones you launch super-reliable (sucks to get them into space and discover they don't work), very feature-rich (to maximize value per launch), as long-lived as possible (to amortize their launch cost over a longer time), and as future-proof as possible (because expanding capacity or capabilities later will be extremely expensive). All of this, of course, makes the satellites themselves extremely expensive. Therefore, there's less market for launches, because there's only so many satellites that it makes sense to launch at $200M a pop.

    Now, imagine that the launch costs go way down. Suddenly, the total cost of launching a satellite also goes way down, and the vast majority of it is now the cost of the satellite. When you can launch two cheap satellites for less total cost than one expensive one and get the same capabilities, or launch four three-year satellites (planning each one to be an upgrade on the last) instead of one long-lived beast that will need bleeding-edge components at launch and still be quite obsolete in 12 years (but costs more than 4 times as much), you will end up with double or quadruple your launch count. When launches become cheap enough that it's viable to build an affordable global personal communication network like what Iridium wanted to be, you'll see a wave of companies wanting to put up the network that will replace the concept of cell towers, and they'll need to put up a *lot* of satellites.

    Also, it's not just satellites. Remember that Dragon 2 is designed to be reusable as well. When launching a human-rated vehicle into orbit becomes cheap enough that space tourists don't have to be one of the 0.001%, you'll have a lot more people lining up to go... and you'll need places for them to go, so that'll increase your satellite market again as Bigelow and such launch space hotels. Then there's things like asteroid mining, which is currently hampered by launch costs but could become a regular source of launch contracts if the costs come down enough to make the business model viable.

    As for "any time soon"... launches are already accelerating. It'll snowball as prices drop, as reliability increases, and as capacities expand.

  15. Re:borg^h^h^h^hSpaceX interpret damage as educatio on SpaceX Successfully Lands Its Rocket On A Floating Drone Ship Again (theverge.com) · · Score: 2

    Hopefully they'll post an aerial video soon, though the quality will still be less than that amazing video of the daytime landing.

    On the live feed, a bunch of people sort of sighed or went "aww" as the screen lit up with the glow... I guess it kind of looked like the rocket had exploded, and the video was frozen before that so you couldn't tell what had happened. Then the exhaust and glow start to clear and you can see the intact landing legs and engine nozzles, and all hell breaks loose.

    I was dancing in my chair. What an incredible thing to see...

  16. Arguably a first on SpaceX Successfully Lands Its Rocket On A Floating Drone Ship Again (theverge.com) · · Score: 5, Insightful

    The headline ends with the word "again", making it sound like this is a repeat of a prior event, but in reality this is very much a new achievement. The first two successful landings were from relatively light payloads sent into low Earth orbit (LEO). This mission was sent to geosynchronous transfer orbit (GTO), a much harder destination. The max payload for GTO is well under half what it is for LEO, because you need to get the satellite going much faster.

    To get a big satellite to that orbit, SpaceX has to push the launch vehicle a lot closer to its limits. The engines burn longer, on the ascent, leaving the rocket with less fuel to try and slow itself for landing. At the same time, the first stage boosts to a much higher suborbital peak. It therefore has to re-enter through more atmosphere, while going faster, with less fuel to slow down. The increased speed and distance means more heating of the bottom of the rocket, which doesn't have anything like the heat shielding a Dragon capsule (or similar) would. Fortunately, it's not going as fast as an orbital capsule... but it's still going a lot faster than it would be on a launch to LEO.

    Demonstrating that the first stage can be recovered even after a launch to GTO is a really big deal. In it's own way, it's as big a deal as the first two successful landings. In December we saw the first ever landing for an orbital booster, then a few weeks ago we saw the first ever landing at sea (which is necessary for GTO boosters to have any hope of landing, but that launch was a LEO launch). Today, we saw the first even landing of a GTO launcher. That is a huge deal!

  17. Re:Frivolous lawsuit on Snapchat Sued For Facilitating 107 MPH Car Crash (patch.com) · · Score: 1

    Depends on the state, but around here, 50MPH over the limit (especially if you run into somebody at that speed) is less a "license is suspended" and more a "have a nice stay in prison", and if you're really lucky and also don't live in an urban area, you might eventually be allowed to have a restricted license that allows you to commute to work (assuming you can find any with that record) and nothing else.

    Mind you, I don't agree with this country's general stance against rehabilitation of criminals (and then letting them be productive citizens again afterward). This is no "got caught with some drugs" or "stole a TV" crime, though; depending on the damage, she may have effectively ended the guy's life. Apparently her response to this scenario included taking a selfie of it. She could probably benefit from a few years of having fewer opportunities to make the wrong decisions. Maybe she'd even learn something...

  18. Re:If media companies can say millions lost on Ask Slashdot: Should This Photographer Sue A Hotel For $2M? (google.com) · · Score: 1

    There is no difference. The "millions lost from one file" thing is applied to the uploader (who presumably bought a copy), not the downloaders. They do go after the downloaders too, but not for anywhere near as much (unless they were also uploading).

  19. Re:Even if you force me, I won't Bing anything. on Microsoft Limits Cortana Search Box In Windows 10 To Bing and Edge Only (venturebeat.com) · · Score: 1

    Speaking as somebody who (unlike you, obviously) actually uses both: no, it's just irrational. I can think of one time in the last month a Bing search didn't have the result I wanted on the first page, and one time for Google.

    My interests are software dev (mostly native code, .NET, and Java, but work sometimes requires everything from Node.js to Perl), InfoSec, webcomics, spaceflight, both domestic and international travel, US politics, cognitive science, phone jailbreaking, strategy gaming, and a bunch of other stuff (much of which is relatively obscure). I don't let Bing or Google track/customize my search results. If either one (or DDG) were dramatically better at finding what I'm looking for, I'd know it. They aren't.

    I will admit I find it annoying to keep up with the changes in search syntax between the various engines, and that would be simplified somewhat if I just stopped using any but one. That wouldn't make the one I chose to use better, though, just more familiar to me (and I'll be really surprised if you can present to me a good argument that Google's search syntax today is objectively better the either of the others I use).

  20. Well-written, logically thought out, and even reasonably polite! It's a Slashdot miracle.

  21. Re:Fine with me, for now on Microsoft Limits Cortana Search Box In Windows 10 To Bing and Edge Only (venturebeat.com) · · Score: 1

    Yep. Launching programs (including control panel / MMC snap-ins) is much faster via Start search than via any other means short of Quick Launch (which is all that "pin to taskbar" in Win7+ really is). So yes, the most commonly-used stuff gets pinned, but I try to keep the count of pinned items below 10 or so, and I use a *lot* more than 10 programs.

  22. Re:Antitrust violation? on Microsoft Limits Cortana Search Box In Windows 10 To Bing and Edge Only (venturebeat.com) · · Score: 1

    Ha! That's a pretty funny set of results. Would installing a DDG app help with that last case, perhaps?

  23. Re:Even if you force me, I won't Bing anything. on Microsoft Limits Cortana Search Box In Windows 10 To Bing and Edge Only (venturebeat.com) · · Score: 3, Interesting

    Wow, that's got to be the most irrational position on a search engine I've ever heard. Blind devotion to one particular engine is foolish enough, but intentionally wasting your *own* time instead of using the results in front of you? That's just stupid.

    I use Bing. I use Google. I use DuckDuckGo. I use at least two of them on almost any given day. Many days I use all three. Absent situations where I know the results will be off because I used (or failed to use) site-specific syntax in my search, I don't care much which one I'm using. DDG for sensitive-ish stuff (default on my work machine) but it's annoying otherwise because opening its links is slow. I use Bing and Google pretty much interchangeably beyond that. Some searches produce better results in the one, some in the other. It doesn't make a difference.

    Hell, I'd probably even use Yahoo if I had any reason to. I replaced Firefox with Pale Moon, though, and seem to therefore not have any browsers configured for Yahoo (and I'm not going to bother changing that).

  24. Actually, the iPhone in 2007 showed that the future was a touchscreen that could browse the web and play music. Other smartphones of the day already had installable apps; the iPhone did not. It wasn't until the app store was launched in July of 2008 that the iPhone even came close in general-purpose usability to the devices that immediately predated it.

    To Apple's credit, they managed to market a so-called smartphone that *couldn't* run apps quite well, and then successfully pivoted to "there's an app for that" once there was, and this has set the general trend of the industry ever since. It didn't start out like that, though.