Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Comments

top

Lead Mir Developer: 'Mir More Relevant Than Wayland In Two Years'

Error27 Re:Why? (225 comments)

My read of the article is that the problem with Wayland is that the devs were writing specs instead of software. There was lots of planning and no doing. Remember that originally Ubuntu was supposed to be running X-Mir by default in Oct 2013.

Those days were more optimistic times for Ubuntu and they thought they could create a new display server in a year. These days Mir and Wayland seem to be at about the same stage of readiness.

about a week ago
top

Apple Announces Smartwatch, Bigger iPhones, Mobile Payments

Error27 Re:iPod Classic (730 comments)

Sony sells a walkman branded mp3 player with a scroll wheel.

http://www.amazon.com/Sony-NWZ...

It's not quite as good as the Apple wheel because you just press on the side of the wheel instead of spinning it. That's the only bad thing otherwise it's basically the same.

about a month and a half ago
top

Not Just a Cleanup Any More: LibreSSL Project Announced

Error27 Re:Get it FIPS certified (360 comments)

If you read the article then you'll see that the OpenBSD explicitly rejects FIPS certification as a goal.

FIPS certification is why OpenSSL includes the NSA backdoor DUAL EC pseudo random number generator. The code doesn't work but it's still included and can't be fixed. Anything which leads to an outcome like this... Disgust. Disgust and revulsion.

about 6 months ago
top

How Does Heartbleed Alter the 'Open Source Is Safer' Discussion?

Error27 Re:Original premise is false (582 comments)

This code could have easily been detected with static analysis. It's a common failure pattern. You just taint data from the network as untrusted and look for when invalid use cases.

I do static analysis like this on the linux kernel for a living.

about 6 months ago
top

ZunZuneo: USAID Funded 'Cuban Twitter' To Undermine Communist Regime

Error27 Re:that's really stupid of them (173 comments)

It's not clear that USAID was at the front on this opperation. They were funding it secretly through shell companies. When it comes to clandestine operations the CIA has better qualifications. It's just stupid, and more stupid.

about 7 months ago
top

ZunZuneo: USAID Funded 'Cuban Twitter' To Undermine Communist Regime

Error27 that's really stupid of them (173 comments)

The government already has the CIA for this stuff. It was amazingly dumb of USAID to start doing the CIA's job. The head of USAID should resign followed by a full investigation.

But that won't happen because the government has stopped caring about appearances any more.

about 7 months ago
top

Obama Announces Surveillance Reforms

Error27 "No evidence of abuse has been found" (359 comments)

Obviously LOVEINT is one example. But more details are coming out about how David Patraues was caught having an affair because of "metadata" collected by the NSA.
http://www.charlotteobserver.com/2013/06/17/4111871/metadata-helped-reveal-gen-petraeus.html#.Utlud2nfqCg

When Jill Kelley first reported getting threatening emails about Patraues, the FBI read all her emails as part of "a routine step".
http://www.nytimes.com/2014/01/06/us/from-petraeus-scandal-an-apostle-for-privacy.html

They didn't have a warrant to read her email, they just hacked into google and made a copy of everyone's email. If you report a crime to the FBI they read your email. Simple as that.

about 9 months ago
top

Thousands of Gas Leaks Discovered Under Streets of Washington DC

Error27 Re:Sensationalist headline is Sensational (292 comments)

Typically these leaks are very small and are no danger to the public, which is why they are allowed to persist.

You didn't read the article. You didn't even read the summary. There were 12 which were dangerous. They reported them and the gas company had only fixed 3 of them four months later.

about 9 months ago
top

NYT: NSA Put 100,000 Radio Pathway "Backdoors" In PCs

Error27 Re:Doesn't pass the smell test (324 comments)

The 8 mile thing was an NSA transmitter in a helicopter. It was used to hack someone's system through a bug in their wifi drivers.

about 9 months ago
top

Even After NSA Leaks, Government Still Trusted Over Private Firms

Error27 It's not about fighting terrorism (234 comments)

Reasonable people don't believe that Angela Merkel is a terrorist. Instead talking about terrorism, it's more important to talk about how the NSA spying benifits us during trade negotiations.

Technically, I suppose it doesn't benifit all of "us"... Oh well. Sucks to be you I guess.

about 10 months ago
top

RSA Flatly Denies That It Weakened Crypto For NSA Money

Error27 Re:The Case of the Dog That Didn't Bark (291 comments)

The NSA documents on this have been leaking for a while. There are ones that dealt with pushing DUAL_EC through NIST. The documents dealing with RSA are separate corroborating documents which fill in some details.

It's likely that the NSA documents on subverting OpenSSL will leak eventually. Anonymous government sources estimate that at the current rate the NSA leaks will take two more years before they have all been released.

about 10 months ago
top

RSA Flatly Denies That It Weakened Crypto For NSA Money

Error27 They're not denying the article really (291 comments)

They're just claiming again that they assumed the NSA were good people.

This all happened in 2006. RSA adopted DUAL_EC. RSA was sold to EMC. NIST released the standard. Microsoft researchers showed the flaws in DUAL_EC. The flaws in DUAL_EC have been known since 2006, the only thing we didn't know was that they were deliberate.

Also it's interesting to note that an anonymous organization paid for the same DUAL_EC algorithm to be added to Open SSL. With Open SSL at least they didn't make it the default but it's not far off from what RSA did.
http://arstechnica.com/security/2013/12/nsas-broken-dual_ec-random-number-generator-has-a-fatal-bug-in-openssl/

about 10 months ago
top

NSA Says It Foiled Plot To Destroy US Economy Through Malware

Error27 The US has this capability, of course (698 comments)

http://www.theinquirer.net/inquirer/news/2290640/germany-warns-against-using-windows-8-due-to-security-risks

You just revoke the keys and suddenly the machine can't boot.

It's funny how the NSA accuses China of inserting back doors but Snowden shows how the NSA inserts back doors. China hacks into systems but Snowden shows the NSA has hacked into tens of thousands of networks. And now the NSA is bragging about preventing a shutdown button when we already know it did the exact same thing.

about 10 months ago
top

Employee Morale Is Suffering At the NSA

Error27 Re:problem is (841 comments)

We can be pretty sure that the NSA data gathering was a part of how General Petraeus was forced to resign.

The NSA shares its data with 11 other federal agencies such as the FBI (crime stoppers), IRS (tax collectors), DEA (drug wars). It may be that the FBI acted alone using already shared metadata information from the NSA. Or it may be that the NSA was more actively involved. If they were involved, that information would be classified.

Petraeus stood a reasonable chance of being elected president. The information was there because the NSA collected it. At a certain point it was decided to force him to resign. That decision was a political one because it has a political impact.

about 10 months ago
top

How Your Compiler Can Compromise Application Security

Error27 Re:Inflammatory Subject (470 comments)

It doesn't forbid it. GCC doesn't even warn about it when it silently removes things. In the kernel, we turn most of these optimizations off now but before then it did cause kernel security bugs.

My guess is that you didn't read the PDF?

about a year ago
top

NSA Director Keith Alexander Is Reportedly Stepping Down

Error27 That's good news (92 comments)

One thing that people talked about was that Alexander knew too much dirt on everyone and couldn't be forced to resign. It makes it easier that he stepped down voluntarily.

If you think about it, the NSA had enough information to force former CIA director David Patraeus to resign. I'm not saying they did, I'm just saying that they had the information and could have done it if they wanted to. But at the same time they were not able to prevent actual terrorists like the ones who attacked Westgate mall. The difference is that it's easier to spy on normal Americans than it is to spy on terrorists.

1 year,7 days
top

The Linux Backdoor Attempt of 2003

Error27 Re:C/C++ operator = (360 comments)

I actually fixed one of these bugs in the kernel last month.

But you are right that these are very rare. I have did a git search of patches which only add a single '=' character and there are normally two kernel bugs like this per year. In other words, we have 50,000 patches per year and only 2 patches have this sort of bug.

I have spent quite a few days auditing for these bugs in the kernel. They were rare the first time I audited in 2002 but these days we have several ways to make them even more rare.

Imagine you have "if (x = foo) {":
1) GCC suggests using extra parenthesis around the assignment like "if ((x = foo)) {"
2) Checkpatch.pl suggests breaking it up into two statements. "x == foo; if (x) {".
3) Static checkers complain about it if foo is a constant, or if the checker is in verbose mode, then it complains if foo is not a function call. (A lot of static checkers complain. It's a favorite thing to look for).

One thing that I have just thought of is that we should have a warning where checkpatch.pl complains if people do: "if ((x == foo) || (x == bar)) {". Sometimes it's hard to know where to add parenthesis for readability, but for comparison operations the parenthesis are obviously bad style.

1 year,14 days
top

NSA Bought Exploit Service From VUPEN

Error27 Re:The truth gets out... (81 comments)

This isn't the only way or even the main way that the NSA exploits systems.

Things we know:
1) The NSA collects SSL keys.
2) The NSA can generate fake SSL keys.
3) The NSA has performed MiTM attacks against Google and Microsoft.
4) We know where many of the places are that the splice into the undersea cables.
5) US embassies often have Echelon hardware for tracking satellite communication.
6) The GCHQ stores three days of internet traffic (not metadata but everything).
7) The NSA collects metadata from everything. Email. Phone. Letters. Facebook.
8) The NSA planted spies in large corporations.
9) The NSA have influenced/degraded encryption standards.
10) The US government and Israel created stuxnet.
11) The NSA monitors all credit card transactions outside of the US.

We don't know the specifics though. We don't know:
1) If there is a backdoor in Windows or Linux or libssl.
2) If hardware random number generators have been backdoored.
3) If there are backdoors on the motherboard or in the ethernet firmware.
4) How they are tracking in other ways, via license plate readers or sensing your various personal radio devices.
5) How are spy satellites used for domestic surveillance?
6) Just how much information is shared between the agencies to avoid fourth amendment rules. We know that the NSA and the GCHQ share an office. We know that the NSA gave unfiltered data on non-criminals to Israel.

about a year ago
top

NSA Spies On International Payments

Error27 Re:News? (314 comments)

That same logic could be applied to anything. "You were mugged on the way to work? That's what muggers do. Boring."

This is interesting because it shows:
1) How the internet changes spy craft.
2) How dangerous it is to aggregate data.

It raises interesting questions:
1) Have other countries infiltrated VISA as well?
2) Has VISA been infiltrated by organized crime as well? Would that be profitable?
3) What personal information is there?
4) Has the private data been used for black mail people in interesting ways?

This revalation requires some actions in response:
1) VISA can't just allow their private data to leak.
2) Other countries where this is illegal might consider a response.
3) The IT industry must take more action to prevent this kind of attack.

There are also legal issues:
1) If this hurts VISA, then can the NSA be sued for the loss in business?

The timeline from now looks like:
1) Next six months: More NSA activity will be uncovered. NSA front companies will be exposed. Techniques will be analyzed.
2) Next few years: Changes to the IT industry such as updated encryption. Finding fixes/replacement for SSL since it has failed completely.
3) Next decade: Countries and corporations will have to update their IT budgets and what tech they buy.

This assumes that Snowden does not leak the 400Gb of data in his insurance file. If that happens then much of the web will have to be shut down for a couple weeks. The stock market will collapse. Government officials in many countries will have to step down as we learn more about their private life.

about a year ago

Submissions

top

Trans Pacific Partnership includes parts of SOPA

Error27 Error27 writes  |  about a year ago

Error27 (100234) writes "Last month Wikileaks leaked a draft of the Trans Pacific Partnership treaty. Here is Congresswoman Zoe Lofgren's response to the leaked documents. She points out that there several troubling issues with the trade agreement. It locks countries into extremely long copyright terms. It limits fair use. It includes DRM provisions which would make it illegal to unlock your cell phone. These laws come from the Stop Online Piracy Act (SOPA) which Americans already rejected."
top

Error27 Error27 writes  |  more than 8 years ago

Error27 writes "Gizmodo has a writeup on the Neuros OSD media center. They encourage hacking and are offering several hacking bounties. It looks pretty awesome except it doesn't have internal storage or wifi. At this point, only 200 beta units are available from Think Geek. More info available at the Neuros wiki."

Journals

top

Vista is crap

Error27 Error27 writes  |  about 6 years ago

Most people say Vista is crap but I always figured that's because they were jealous of Bill Gate's billions. It turns out they were right!

Vista is horrible. The UAC dialogues do pop up all the time. You click on about any button and the screen flickers and goes dark except for the UAC dialogue.

The dialogues are stupid too. So far I've only seen the one where if you click on a button and it asks you "Did you just click on a button? Press cancel if this program started automatically." It's every third button that generates this dialogue. This is on a brand new Vaio without anything extra installed.

Vista automatically updates which is good, but then it also automatically reboots your computer when it finishes!

Also when you uninstall the AOL tool bar that makes Vista reboot. It doesn't ask you. It just reboots. You think probably I'm lying, but I'm not.

You know how all windows computers seem to have an expired copy of Norton on them? I always thought that was because idiots downloaded the trial version. I was wrong, they install nine almost expired applications including Norton at the factory.

What a load of absolute crap...

top

Excel sucks

Error27 Error27 writes  |  more than 6 years ago

I recently got to use Excel to do some data entry at a non-profit. Excel 2003 sucks.

1) Only one undo.
2) I accidentally modified a cell and entered something invalid. It wouldn't let me quit until the problem was fixed. I couldn't undo it because of problem #1. I had to hit CTRL-ALT-DEL and revert to the last saved version.
3) You can't put tabs into their own window. I ended up copying stuff into notepad then opening the other tab and copying it there. Twice as much work.
4) The presentation is so easy to screw up and so pointless. For example cut and paste removes the borders and formating. When I first got this document half the little boxes were missing a border and there were mixed up fonts all over.

I could go on. It's just a mess. Basically the message for Microsoft is that, "Hey you guys suck. Not just a little bit, a lot. I mean really really suck."

top

Spam thoughts

Error27 Error27 writes  |  more than 9 years ago

I get a lot of spam from people claiming to be Washington Mutual Bank. I think the way to stop this kind of spam is through email servers automatically signing things.

Basically each TLD would have a very secret key. When you register your domain name they would sign your public key. Then when you would set up your email server to sign every outgoing email. Your email server would also send a signed copy of its public key with each email.

Then say I recieve your email. My email client would verify that the TLD had signed your public key and that the email had originated from you and that you are Washington-Mutual-Bank.com.

The previous paragraph illustrates a flaw in my plan. You could just register a legit sounding domain name and send spam from that... But overall I think it's a good plan. It wouldn't cure the problem, but it would certainly help.

[I've left out a bunch of implementation details on purpose, but it would be simple enough to implement this.]

top

Patents: A new way to generate revenue for open source

Error27 Error27 writes  |  more than 10 years ago

There are two problems with software patent. First, they violate First Amendment free speech rights. Second, Free Software programmers have no money to buy them. I think that both of these can be dealt with and that the Free Software Community should embrace software patents.

The issue of violating the first amendment rights is a big issue. Fortunately, with patents covering GPL code would only stop non-free software from being published. Many people in the free software community view non-free software as unethical, and with software patents, it could also be illegal. A second justification is that it's better to oppress your competition than be the victim. The doctrine of preemption applies here. A third justification is that software patents are not morally wrong, it's not like you're doing anything illegal.

The problem of not having money is just a matter of perspective. If you buy a software patent, then you can sue people with it down the line and recoup your investment. There are people who would be willing to buy your patents.

If I remember correctly, it costs around $10K to buy a patent. I would be willing to sell a patent to someone else for $15K. That person could then wait for 5-7 years and then start licensing the patent for non-free software or suing people who refuse to license.

In fact, here is my plan. I'm going to open my software up so that anyone can patent any aspect of it if they pay me $5K. They would have to take care of all the patent paper work and they wouldn't be able to sue anyone over GPL licensed software but otherwise, they'd be free to sue anyone they wanted.

In the coming years, Microsoft will use patents to try slow Free Software development. They will succeed. Fortunately, the Free Software community
can fight Microsofts assault by selling patent rights to lawyers.

top

p2p project delayed

Error27 Error27 writes  |  more than 10 years ago

I've been working on a p2p system on and off for the last couple years.

I think this is the first time I ever mentioned it online and that was over 2 years ago. At the time I was trying to figure out how to have private networks... It turns out the answer is not too difficult.

1) Each network has a password.
2) Take the password and your IP address and hash them.
3) Send the hash to the other people in the network.
4) The other people know the password and they know your IP address. They hash them and compare it with the hash that you sent. If it matches then you are accepted in the network.

Of course, that doesn't deal with the case where your ISP is listenning to your traffic. Your ISP can just test all the words in the dictionary until they get one that leads to the hash you sent. But I can accept that for now, I guess.

Any way... I had hoped to get a text based demo version ready and submit a paper for CodeCon, but I won't be able to make it in time.

That's too bad...

Slashdot Login

Need an Account?

Forgot your password?