Catch up on stories from the past week (and beyond) at the Slashdot story archive


Forgot your password?
Check out the new SourceForge HTML5 internet speed test! No Flash necessary and runs on all devices. ×

Comment Re:what we need here is a mentality reset (Score 4, Insightful) 86

Google's safe browsing list have been in both Firefox and chrome since chrome's first release, and both Firefox and chrome have a toggle to turn it off in the options should you wish. For some reason Google has added pirate bay download pages to the list, according to database lookup it matches the sort of block they usually impose when the site has been compromised either directly or via maleware embedded in advertising.

Comment Re:Why are they net accessible? (Score 1) 54

So they can track everything, seriously. Most of these devices have no real need of an internet connection.

Anyway, that said, even my routers are using HTTPS, with a key and certificate pair generated by me for my own CA, it is possible, and not all that hard. I just added a HP printer to my network, again I uploaded my own certificate to it, it even had a nice wizard that generated the CSR which I then signed, run the wizard again and choose to upload the certificate.

Comment Re: DMA (Score 1) 85

No USB does not have DMA exposed to external devices, the USB host controller may use DMA as it is just another device on the PCI/PCI-Express bus, however it is not expose and queriable by devices. Yes, later in FireWire, some operating system drivers (Linux and Windows) would request the FireWire controller disable DMA support, but the hardware needs to be built to have this functionality. Finally such functionality would break thunderbolt as DMA is a fundamental part of how PCI-Express works and as a such key to the functionality. There is a feature for virtual machines to allow PCI-Express pass though called IOMMU that could also be used as DMA mitigation as it works by pretending to the device only a section of memory is the whole system memory, however, I believe only kernels built for use as hypervisor have it enabled and none are actually using it for DMA mitigation.

Comment Re:HORNET, next gen Tor @ 93Gb/s (Score 5, Informative) 89

The problem with Tor is not throughput but latency, and the latency issue in Tor exists as a protection against timing attacks. Basically, Tor nodes capture several requests to pass on, then wait, only sending in batches on a given interval, they also shuffle the order of the batches, 3 hops later and all these waits add up. Without this method, one could easily watch packets going into and coming out of the network and just match them up, as they come out in the same order a few milliseconds later, with the batching you have no idea which packet matches with which one going in.

Comment Re: This Is Crap (Score 1) 85

Thunderbolt is a major security issue as thunderbolt devices (along with all PCI, PCI express, expresscard and FireWire) have direct memory access. Direct memory access allows reading and writing directly to the system memory bypassing the operating system and any protections it has. This is for performance reasons and makes some degree of sense until you start to put it on external interfaces users will plug anything into... FireWire was not allowed in a lot of companies for exactly the this reason.

USB has its own security issues inherent in it, though not as bad as bypassing software protections and in some more sensitive workplaces they have the USB ports sealed too. What are you going to do when there is no other option than to plug the monitor in view a USB port, you can't seal ports that use insecure protocols if all devices, secure or not use the same port. Oh and now, I can hide my attack in the display that usually would only give me HDMI ddi data access with a lot larger attack surface.

Comment Re: HDMI is from the world of USB 2.0 and 1080i. (Score 1) 85

Until you want 4k@144hz...
Oh and yes a human can distinguish the difference in framerates above 60Hz, especially with interactive media. The
This is why current vr headsets run at 90fps of 120fps, humans do distinguish it and the latency between head tracking and display update can cause simulation sickness.

Comment Stupid from a security sense (Score 1) 85

We all know USB already has various security issues by its nature. And until they added (the little used) Ethernet causality down HDMI cables, we were pretty safe from video cables being an attack vector, but if we start all pushing it down USB. What's to say my companies smart TV on a firewalled subnet that I also use as a secondary display doesn't also connect thunderbolt or USB down one of these cables? No more just not plugging suspicious devices into USB ports when all the machine has is USB ports. This is getting ridiculous.

Slashdot Top Deals

If I were a grave-digger or even a hangman, there are some people I could work for with a great deal of enjoyment. -- Douglas Jerrold