Slashdot Mirror


User: cbhacking

cbhacking's activity in the archive.

Stories
0
Comments
4,314
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 4,314

  1. Re:using Windows Firewall on Windows Remote Desktop Exploit In the Wild · · Score: 2

    Not from a random machine on the Internet (barring an additional bug in Windows Firewall), no. The firewall filters packets before they reach the server program, so the exploitble software would never be executed.

    However, if you trust *any* hosts, then you're also opening yourself to any attacks that those machines are vulnerable to. A bug like this, once weaponized (contrary to the title, I don't know of any remote code execution exploit in the wild for the vulnerability, though you should assume one exists anyhow), makes an ideal propagation vector for a worm. Remember, security is a chain of trust, and only as strong as the weakest link.

  2. Re:Did anyone think it was secure anyway? on Windows Remote Desktop Exploit In the Wild · · Score: 5, Insightful

    That's just placing trust in the VPN software, rather than the terminal services server. How does that help? You may trust a particular VPN implementation more than you trust any code out of Microsoft, I guess, but RDP is already encrypted and can be configured to use fairly good authentication.

    Yes, for a business, it is expected that a VPN would be required (because there are a lot of network resources beyond RDP, and because the internal network is typically behind a proxy), but for a home connection that seems excessive. RDP is disabled by default on home installations, but plenty of people enable it at some point and don't later disable it even though it's a potential attack vector - much like SSH, which people also often use without VPN.

    Additionally, there's always the risk of things like a disgruntled employee using this attack from within the corporate network to attack a co-worker (or manager) by changing something on their computer or stealing their credentials, or a corporate spy using it to gain access to data they shouldn't have, or... For remote security vulnerabilities, you need to be a lot more imaginitive in considering threat cases!

  3. Re:I hate CFLs on ESL — a CRT-Based Replacement For CFL Lights Without the Mercury · · Score: 1

    You're confused by the "failure" mode of LEDs, though. They don't really burn out, not under any reasonable timeframe. Instead, they very slowly dim.

    The expected lifetimes are typically to the time when they produce 85% of their original light output. If that's still an acceptable level to you, you can get years more usage out of them.

  4. Re:wondering what the lawyer to developer ratio is on FTC Attorney Joins Microsoft · · Score: 1

    Actually, their Legal and Corporate Affairs group took a significant hit (much worse than engineering) in the layoffs during the 2008 recession. This could (I make no claim whatsoever that it *is*, though) be as simple as them hiring back up to strength with people they expect to be useful to them.

    Microsoft still has tons of Dev/SDET/PM positions open; many more than legal positions, going by their hiring website. I have no idea what the delta in ratio is, though, or how many of each are currently (or were previously) actually employed.

  5. Re:Doesn't matter on Sony Ditching Cell Architecture For Next PlayStation? · · Score: 3, Interesting

    So, where were the universities going to get replacement hardware when their machines start breaking down? Newer consoles that come with the firmware update blocking Linux and can't be downgraded? PS3 Slim consoles that never had Linux at all (officially speaking; they can run it just fine in reality)?

    The only thing that stops me from hoping that Sony dies in a fire is the risk of what level of unethical behavior it will permit their direct competitors to stoop to, when there's one less alternative for people to switch to. I'm under no delusion that any megacorp is going to behave any more ethically than its bottom line dictates. The disgusting thing is that Sony can't even measure up to that.

  6. A few actual things on Microsoft Launches Windows 8 Consumer Preview · · Score: 4, Informative

    Since you'll otherwise just get a bunch of sarcasm...

      * Memory page de-duplication (automatically reduces system memory usage in most use cases).
      * Lower base memory usage than Win7 (pretty impressive, IMO).
      * Improved file operation interface (copying/moving files now shows all ops in one window, allows pausing, and generally provides more info).
      * IE10 is built in (I assume it will be backported; it's a nice release).
      * ISO mounting without additional software (finally!)
      * App Marketplace (not mandatory, but convenient).
      * Sign in with your WLID (now called "Microsoft Account"; enables syncing favorites, settings, and user-selected files/folders, plus downloading your Marketplace apps on other PCs).
      * Automated ability to restore the OS to basic post-install state without losing the user's files or customizations (simplifying and speeding up the "pave-it-over" solution).
      * Vastly improved multi-monitor support (taskbar spanning both monitors, wallpaper spanning the monitors, separate wallpaper on each monitor, each monitor gets taskbar icons for the apps open on that monitor only, and other options).
      * Improved theme capabilities (automatic selection of chrome color based on current wallpaper, even during "slideshow", for example).
      * Built-in antivirus option (Microsoft Security Essentials is now integrated into Windows Defender).

    There's more, that's just what I remember from some of the demos I saw and my own personal experimentation.The "BUILD" conference demoed a lot of stuff, and that was before the release of the previous preview. I'm also just mentioning things that matter to the user, not mentioning the new developer features (though of course BUILD had a bunch of info about those).

  7. Re:Tethering on AT&T Should Be Investigated For 'Fraudulent' Data Policies, Says PK · · Score: 1

    T-Mobile will allow you to use a smartphone without a data plan, so long as you buy the phone up front (or bring your own). They are, so far as I know, the only one of the 4 major carriers in the country that allow this.

    I'm not sure why they get so little mention, here - easily the least "evil" of the major mobile operators in the USA, certainly compared to their direct competitor (AT&T - Sprint and Verizon use CDMA2000, not GSM/WCDMA) - but people make blanket statements about "the operators in the US" that apply to all of them except T-Mobile and completely fail to mention this. I get that their network coverage isn't as good as AT&T or Verizon, but it's good enough for the vast majority of the populace.

    A few months ago, when it looked like they might get bought out... that wasn't such a good time to be a TMoUS customer. Now, with that plan firmly on the rocks and their parent company DT investing the compensation from the failed deal into expanding the network and upgrading the infrastructure, this is a potentially excellent time to be a customer.

  8. Re:Scam. on T-Mobile Announces LTE Network · · Score: 1

    To be fair, that's still a better deal than most other carriers offer, where either you'll be cut off, or you'll pay through the nose. Sprint is vetter, but it's the only one.

    Also, they throttle you down to EDGE (sometiems called "2.5G"). It's slow, sure, but it's not unusable (I can even stream music on EDGE) and it's closer to 2004 than 1994 in terms of smartphone speeds (the first iPhone couldn't do better than EDGE at all!) I don't know what the "official" speed for EDGE is, but my (T-Mobile) phone get about 200kbps. That's good enough for most web browsing, uploading a photo to Facebook (if you don't mind waiting a few seconds), and streaming an MP3 (if you don't mind it streaming only slightly faster than real-time, which makes skipping ahead very slow).

  9. Re:Stop masturbating over apple on Apple Intern Spent 12 Weeks Porting Mac OS X To ARM · · Score: 1

    I'm not sure about Palm, but neither Symbian nor Windows Mobile were anywhere near so locked down as iOS. You could install whatever apps you wanted, tweak almost everything, run as whatever the OS's equivalent of "root" was easily, and in some cases even build and custom install custom ROMs quite easily. iOS has none of that.

  10. Re:Good article, bad summary on A5 Mystery Solved (Why Siri Won't Run On iPhone 4) · · Score: 1

    Given the antenna troubles, by that argument they should have removed the ability to place phone calls in the first update to the iPhone 4!

    Yes, voice recognition with background noise is a problem... but claiming that the new processor is *the* reason for its exclusivity is quite ridiculous.

  11. Re:The power of privacy on Do You Like Online Privacy? You May Be a Terrorist · · Score: 4, Informative

    This is actually a good point. I don't know about the FBI, but some friends of mine work for Boeing and have filters on their laptops' screens that massivle narrow the viewable angle (so somebody sitting behind and to one side of you can't read the screen).

    The reason? They have security clearance, and might accidentally have confidential info on their screen for a moment when they log on in a public place. The filter screen helps keep their display private... but it's exactly the kind of thing that is being suggested to be suspicious.

  12. Re:One thing i never understood on Microsoft Releases Kinect For Windows · · Score: 3, Informative

    The up/down is for people who are different hights, or for games which are better played sitting/kneeling vs. standing. I don't know, maybe everybody who uses your kinect are all the same hight and always use it from the same position, but for the rest of us that motor is pretty important.

    The spacing on the visual sensors doesn't require such a wide sensor bar, but the spacing on the microphones (for effective direction-sensing and noise-cancelation) does. People always focus on the optical portion of the sensor, and ignore the highly-focused microphones (possible because they're harder to see).

  13. Re:What about Windows Mobile? on Nokia CEO Blames Salesmen For Windows Phone Struggles · · Score: 2

    Actually, there is some quite compelling argument for this issue. Since long before Nokia started selling WP7, it's been extremely widely reported by customers that even when they walk into a store and specifically ask for a WP7 device, the salespeople refuse to show it or sell it. Yes, you read that right - the salespeople actively refused to sell the customer a product that the customer asked for by name.

    The most common reason, apparently, is actually the same Windows Mobile you mention. Compared to modern smartphone platforms (including WP7), it was at best a niche platform and at worst a piece of shit. The salespeople remember that, and apparently can't even tell the difference between WP7 and WinMo (which is blatantly obvious to anybody who tries using them both for 60 seconds, and I'm talking about the stuff that's more than "skin" deep).

    Hell, this was mentioned on Slashdot in June of last year: http://www.mobile.slashdot.org/story/11/06/10/1936237/Windows-Phones-Getting-Buried-At-Carriers-Stores
    There's plenty of other coverage of this issue, if you do a search for things like "WP7 carrier store" or similar. Another example right from the mouths of customers: http://forums.wpcentral.com/general-discussion/186449.htm

  14. Re:I was a freelancer on Ask Slashdot: Money-Making Home-Based Tech Skills? · · Score: 1

    I'll second this. I started coding before finishing high school, and got my first "real" (summer-long, paid hourly and a damn good rate for a credential-less 18-year-old) job before starting university. The reason? A hobby project I'd developed, and could quickly describe to the manager. That let me break into the world of paid summer internships, which ended up paying for my entire education without requiring me to work during the school year (not an easy task, in the US).

    Now, I'm looking to switch jobs or the first time since graduating. My past experience, both before and after graduating, is certainly valuable... but since I'm likely switching fields as well, there's a limit to how useful that other experience will be. Instead, the thing that got a friend-of-a-friend very excited about bringing me into his company was a demonstration (using my phone) of a hobby project relevant to the new area.

    TL;DR: Hobby projects show both passion and experience, and that's a big part of what employers want to see.

  15. Massive logical fallacies... on Jailbreaking Could Soon Become Illegal Again · · Score: 5, Insightful

    How the <REDACTED> did this get modded up??

    Is that what's happening?

    Yes, in countries that meet the criteria specified in the post you responded to, and even quoted: places where there are "*no* [effective] laws against copying somebody else's work" such as many of the Asian nations I've been to (Malaysia, Thailand, Sri Lanka, Nepal, Indonesia, etc.), and a lot of Africa as well. Also certain parts of South America, though it's slightly less widespread there (in my experience).

    Do you see pirated DVDs and CDs on the shelves at Best Buy?

    Well, they don't have Best Buy in those countries, but everywhere that you can buy a CD or DVD, from a streetside vendor's cart to a chain of media retailers with a presense in most large malls, is selling mostly if not entirely pirated CDs and DVDs, yes.

    Can you tell me which theaters are showing pirated films?

    In those countries? (Almost?) all of them. The hard part would be finding one which *isn't* doing so. The better ones will use copies that were made with something better than a handheld video camera pointed at the screen, but it will still have stupid things like subtitles in a language nobody in the country speaks (not English).

    You'll also find photocopied "books" printed on standard-size paper and bound with plastic rings, CDs/DVDs listing 5 different popular pieces of software plus cracks and/or keygens, and copies of well-known photos or other graphical art (either in printed form or in bulk on a CD).

    The interesting thing about all this copyright-ignored media is that, aside from a few pieces from successful "locals" (literally, fewer than ten per nation), it's produced elsewhere in the world - in the US, Canada, the EU, NZ, or Australia, typically - because in such countries it's feasible for people to actually make a living creating such content.

    Why do the apologists for the ridiculous "intellectual property" laws always have to go to imaginary scenarios to try to make their case?

    What do you have to smoke that you can quote somebody's post, including the conditions under which it is stted to apply and still completely fail to understand that it is not being stated to apply universally? Are you one of those idiot Americans (I'm a US citizen myself, for the record) who thinks that the USA is the entire world, or are you simply completely deluded?

    Hell, there are artists who got their start by distributing their work on bittorrent sites. Without that "illegal copying" those artists would never have gotten a record contract.

    You can't even construct a logical argument out of your own words, never mind when using anybody else's. If the copyright owner is putting the content online for redistribution, it's hardly "illegal copying" anymore. Copyright law allows for the owner of the copyright to distribute their works however they like.

  16. Re:Caches on Startup Combines CPU and DRAM · · Score: 2

    Umm... no. You've apparently completely failed to notice the part where this CPU *has* no cache, at least certainly no L2 or L3. Instead, it talks directly to main memory (which it's embedded in, at least in a portion of, and has extremely fast access to). More accurately, any given gigabit (128MB of RAM) is the cache for one of these CPUs.

    I don't know how quickly they can communicate across the DIMM (each 2GB has 16 CPUs, so some intercommunication is critical) - maybe that's more akin to traditional memory access speed - but it's still a ludicrous amount of "cache" and eliminating the multiple levels of caching greatly simplifies the memory controller logic.

    That said, I wonder how useful a CPU core with so few transistors (and apparently a low clock speed) will be. It's certainly not going to have all the peripheral interfaces you mention - not even close.

  17. Re: not trolling, but serious answer on Jailbreak For A5 iOS Devices Released · · Score: 1

    Actually, there's a reasonably active hacker community working on WP7. Nobody has yet found a universal full-unlock (the closest was the ChevronWP7 Unlocker, which let you developer-unlock a device without buying a Marketplace Developer account), but certain types of low-permission homebrew are available for all phones. Some phones (HTC gen1 and some gen1.5, Samsung gen1) have ways of getting full "root" access, and the developer of one of the tools has promised support for more HTC and LG devices in his next release (he's apparently already found the holes that will give sufficient permissions). Nothing very eciting for Nokia yet, but not as many hackers have access to them yet.

    The key point in all cases is that it requires the device be unlocked and the user be interacting with it. You can "unlock" your phone, but you can't use the same hacks to steal data off a phone you stole from somebody or something like that, and you certainly can't use them for a drive-by attack.

  18. Re:IBM on Y Combinator Wants To Kill Hollywood · · Score: 1

    Meh... talk to some of the engineers who were actually working on OS/2. IBM were demanding absurd things of it, and making MS shoulder the risk if those orders from on high didn't work out. Early versions of OS/2 were pure-16-bit (in the days when even pre-NT Windows was starting to go 32-bit) and had a very poor software ecosystem. Microsoft said "We can do better" and started the NT project, which was originally going to be the "new technology" version of OS/2. However, when the Windows API started becoming much more popular with third-party developers, Microsoft told IBM to that if they wanted that much control over OS/2, they could develop the next version themselves. They changed the primary API for NT to Win32 and sold it as "Windows NT", though they maintained an OS/2 subsystem for some years.

  19. Re:legal? on Project Bifrost: (Fission) Rockets of the Future? · · Score: 1

    The factor of 1/2 is irrelevant here - I'm not talking in absolute quantities (and arguably shouldn't have given actual units at all) but in ratios. E/m (energy per unit mass) is a function of v^2. Since energy is relatively cheap (especially with a fission reactor), but mass is hideously expensive, you want an engine with the highest possible exhaust velocity, as that will maximize the E/m ratio very quickly.

    Impulse is another story entirely. Impulse mesures the strength of the engine, not its efficiency. For high impulse, you typically want a relatively low velocity and high mass - this applies to everything from modern chemical rocketry (which is powerful enough to lift itself off Earth directly, something only a few even theoretical high-efficiency rockets can do) to early cannons (which used a heavy shot to maximize the impluse transfer they could get out of the limited energy of low-grade gunpowder).

    Specific impulse (Isp) is the impulse as a function of mass flow. High Isp does not neccessarily mean high impulse - ion drives have excellent Isp, but push so little mass that their actual impulse is very weak - but it is one of the most popular measurements of efficiency for a rocket. In essense, it addresses the question of "If we are unconcerned with energy cost, how much mass do we have to consume to get us there?" (although "get us there" is actually much more complex in a real-world system).

    Of course, extremely high Isp engines do tend to be energy-limited; not necessarily in the ability to supply it, but in the ability to move and dissipate it. In the case of nuclear thermal rockets, the limit is quite literally the melting point of your reactor assembly (including its controls and containment). That's still enough energy to accelerate a good quantity of mass to a truly absurd velocity, though - giving enough impulse to allow (among other things) more than 1G of thrust while still having a sufficient Isp that distant destinations and round-trip journeys become practical.

  20. Re:legal? on Project Bifrost: (Fission) Rockets of the Future? · · Score: 5, Informative

    Nuclear thermal rocket != nuclear pulse rocket. The latter is the classic "Project Orion" engine, utilizing super-critical explosions for propulsive force. The former is actually more akin to a traditional chemical rocket, in that it works by expelling reaction mass from thruster nozzles. However, the energy of the reaction mass is imparted by heat generated in critical or sub-critical (but not super-critical) nuclear reactions. You can use any number of materials for this reaction mass, though the popular ones are hydrogen and water. Neither is inherently harmful, nor is there any reason they would need to pick up radioactivity from the reactor (any more than the cooling water which cycles through the heat exchangers of nuclear electrical plants or naval vessels becomes radioactive).

    The test ban treaty has nothing to do with this. Nuclear pulse rockets are certianly forbidden by the test ban treaty - after all, they are literally exploding nuclear bombs as part of the engine's normal operation - but there's no reason nuclear thermal rockets would be that I can see. The argument about a "dirty warhead" is potentially valid (in that some would claim it, not in that it would be a plausible danger when you consider we already have nuclear-tipped ICBMs). However, there's no law or treaty against launching radioactive material into space. In fact, quite a few of our space probes and planetary rovers use radioactive thermal generators.

    Compared to chamical rockets, nuclear thermal rockets have a vastly higher specific impulse, which is to say that a given quantity of reaction mass (rocket fuel or hydrogen flowing past a reactor) can produce a greater thrust (simply put, higher efficiency). This is due to their (much) higher exhaust velocity. Remember, E (in Joules) = mass (in kg) * velocity (in meters/second) squared. If you divide both sides by kilos (fuel or reaction mass), your energy per unit of reaction mass becomes a function of v^2. In other words, doubling the speed of the reaction mass will get you four times as much energy for a given unit of reaction mass.

    Since the amount of thrust you can get out of the quantity of reaction mass that can be placed on a spaceship is the current limit on spacecraft range, speed, and payload, increasing that efficiency has the potential to revolutionize space travel.

  21. Re:Files = Pokemon on What Happens To Your Files When a Cloud Service Shuts Down? · · Score: 1

    Completely OT, but for a fun exploration of this idea (what happens to game characters when you stop playing) in well-written webcomic form, look up "Kid Radd". Note that some parts of it will not display correctly on modern browsers, but there are places you can download it from that bundle it with a compatible version of Portable Firefox.

  22. Re:Question on What Happens To Your Files When a Cloud Service Shuts Down? · · Score: 1

    Considering the indictment shows internal communications indicating that some people working for MU were using internal search tools to find and distribute pirated files (to employees), I'd say it's quite obvious that "... in which your data is private" does not apply in the least (no matter what MU's stated policies on the subject may have been).

  23. Re:Evidence on What Happens To Your Files When a Cloud Service Shuts Down? · · Score: 1

    Meh. Anybody who depended on a site with a reputation and business practice like MU remaining online indefinitely, to the point that they trusted it with the only copy of some of their personal data, got what they deserved. MU made no guarantees about the safety or longevity of the data you handed them.

    If you want to try filing suit against the company or its management for harm done to you (losing data) due to criminal negligence and violation of their own corporate policies (read the indictment - it's pretty damning if even half of it's true), go right ahead. I still think you're stupid for putting yourself in that situation, but the US courts have a long history of rewarding stupid people who play the victim well enough with fat payout checks.

    Hell, I'm an active member of Xda-Devs (different username), and most files that were too big to host on the forum server were put on MU. This takedown is certainly an inconvenience to me. I lost nothing irreplaceable, though, nor am I going to go whine to Slashdot, the FBI, or the courts about it. You put your data in MU's hands. At that point, it became one of their assets. A rather well-constructed criminal case was built against MU (based on them misusing your data, and the data of others like you, among other things) and they were indicted. In the process, their assets were seized, including those things which you handed them. Sucks to be you, I guess, but doesn't even come close to "trampling our fourth amendment rights" as another poster called it above.

  24. Re:Not that bad on The Headaches of Cross-Platform Mobile Development · · Score: 1

    Slightly off-topic, but an interesting point:

    Windows Phone 7 does actually allow C++ in apps. You have to wrap the API using COM, but that's not hard - an hour of work at worst, once you have the development environment set up - and after that the managed part just uses the ComBridge API (P/Invoke is not supported) to load your COM library and can call into it trivially.

    The catch: ComBridge is not publically documented, and unless you get an exemption from MS your app will be rejected if it uses it. There are a few published third-party apps that use native code, but they're the big names and the must-have apps, not your personal run tracker or whatever. Part of that is because it's much harder to verify any kind of correctness with native code - things like memory leaks and security vulnerabilities are a real risk - and partially because the phone's security model doesn't entirely encompass native code (for example, using native code you can create an app that screen-scrapes other apps, or reads potentially sensitive device information).

  25. Re:wow on Anonymous Takes Down DOJ, RIAA, MPA and Universal Music · · Score: 3, Insightful

    So, let's stack the deck your way.

    Let's assume that there is no NZ law supporting copyright (false).
    Let's assume that there is no NZ law against apropriating the electronic data of other for your own use without consent (false).
    Let's assume that their business was entire conducted in NZ (false, heck, servers were confisacated in the US).

    But, for the sake of argument, let's assume all of those are actually true instead. Ready?

    You still lose. The whole point of extradition laws is that you agree to transfer people who are found to be criminals by another government to that governemnt's control. Iran is a stupid counterexample; we don't have an extradition agreement with them. Many countries have limits to extradition - for example, some will not extradite their own citizens to the US for crimes which the US permits capital punishment. There might even exist countries which will only extradite people who have also performed criminal acts in their current nation (by that nation's standard).

    In any case, those special exemptions to reality that I made for you above? They don't actually apply.