Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Comment Further In To The Enshittocene Age (Score 1) 60

The good news is that Roku has also introduced a recommended content row, that will compile picks from across various streaming services and use AI to point customers toward new shows and movies they might like.

How the fuck does this merit the description "good news?" Here, let me translate this for you:

"We're going to take away the channel selection menu that you put together and prioritized according to your own wishes, and replace it with paid placements and whatever our half-baked Mechanical Turk chundered up. And replace the lower-third of the main screen with video ads."

While you're at it, why not dump dogshit on my plate and call it chocolate cake?

Submission + - xz/liblzma Backdoored, Facilitating ssh Compromise

ewhac writes: A backdoor has been discovered in the liblzma data compression library, whose purpose is to facilitate a compromise of ssh. liblzma versions 5.6.0 and 5.6.1 are known to be affected. Debian's "unstable" and "testing" repos yesterday rolled back the library by pushing version "5.6.1+really5.4.5-1" to mitigate the exposure. RedHat is also recommending all users roll back to a pre-5.6.0 release.

The backdoor is not in the source code, but rather is in the test suite contained in the distribution tarballs. Hostile payloads masquerading as test data are decompressed during the ./configure phase to modify the Makefile and drop modified versions of liblzma_la-crc32_fast.o and liblzma_la-crc64_fast.o. When the compromised library is loaded by client programs (such as ssh), these in turn install an audit hook in the dynamic linker, allowing them to intercept lookups/calls to RSA_public_decrypt@....plt, which it then replaces with its own code. This compromise appears to have only been discovered in the last few days; study of the precise nature and scope of the compromise is ongoing.

Submission + - Malicious code discovered in popular xz utils (arstechnica.com)

Cognitive Dissident writes: Code designed to compromise SSH connections has been discovered in a widely used compression utility
.

The compression utility, known as xz Utils, introduced the malicious code in versions 5.6.0 and 5.6.1, according to Andres Freund, the developer who discovered it. There are no confirmed reports of those versions being incorporated into any production releases for major Linux distributions, but both Red Hat and Debian reported that recently published beta releases used at least one of the backdoored versions—specifically, in Fedora 40 and Fedora Rawhide and Debian testing, unstable and experimental distributions. Because the backdoor was discovered before the malicious versions of xz Utils were added to production versions of Linux, “it's not really affecting anyone in the real world,” Will Dormann, a senior vulnerability analyst at security firm ANALYGENCE, said in an online interview. “BUT that's only because it was discovered early due to bad actor sloppiness. Had it not been discovered, it would have been catastrophic to the world.”

The really worrying part here is that the developer clearly did it on purpose, and he has been on this project for a solid two years. This raises all sorts of questions about the security of Linux in general. How many other 'deep cover' operatives might be planning or actually in the process of inserting malicious code into the Gnu/Linux code base?

Submission + - Red Hat issues urgent alert for Fedora Linux users due to malicious code (betanews.com)

BrianFagioli writes: In a recent security announcement, Red Hat’s Information Risk and Security and Product Security teams have identified a critical vulnerability in the latest versions of the “xz” compression tools and libraries. The affected versions, 5.6.0 and 5.6.1, contain malicious code that could potentially allow unauthorized access to systems. Fedora Linux 40 users and those using Fedora Rawhide, the development distribution for future Fedora builds, are at risk.

Comment If McKinsey Shows Up, Your Company Is Fscked (Score 3, Interesting) 56

John Oliver on Last Week Tonight did a whole show on McKinsey. The service they actually provide, as has been noted earlier in these comments, is a way for management to deflect responsibility for what they were always planning to do, anyway, which is usually budget cuts and layoffs, and/or massive boosts to executive pay packages.

Here's the show.

Comment Ten Bucks Says They Threw Away Their Own Servers (Score 2) 42

"...Although I am unable to go into specifics, we had to evaluate our priorities and had to make the difficult decision to discontinue the service."

"Sensors detect Microsoft OneDrive contract, Captain..."

Narrator: "It was not, in fact, cheaper to host their files in The Cloud."

Comment Re:It's Resume-Polishing Time (Score 1) 196

Incidentally, a circle with a radius of 60 miles centered around the VMWare campus in Palo Alto includes: Monterey, most of Carmel-by-the-Sea, Salinas, Hollister, Manteca, a fair chunk of Stockton, Fairfield, Rocktram (Napa just barely escapes), Novato, Point Reyes Station, and the Farallon Islands.

"Tell me you don't live around here, without saying you don't live around here..."

Comment It's Resume-Polishing Time (Score 1) 196

On December 1, there was a story on SFGate -- the online component to the San Francisco Chronicle -- covering an email Broadcom management sent to all employees announcing:

  • They're going to lay off 1267 workers,
  • A mandatory return-to-office policy.

Said Broadcom CEO Hock Tan, "Remote work does not exist at Broadcom," but then clarified that sales workers and employees living more than 60 miles away from a Broadcom office would be able to stay remote. "Any other exception, you better learn how to walk on water, I'm serious."

The mandatory return-to-office reportedly went in to effect December 4. Now it seems his latest Genius Plan is to squeeze his customers, thinking he's got them over a barrel.

You'll forgive me if I'm not the least bit motivated to apply to work for the guy.

Comment No Strings Attached, Please... (Score 1) 98

Bowling was the family sport when I was growing up, and when all the pin setters were the free-standing type. So I have a deeper than average familiarity with how bowling is "supposed" to feel.

Earlier this year, I saw a string-based pin setter for the first time (Lucky Strike, San Francisco), and was appalled such a thing existed. Based on what I could see from my end, I initially thought the design's appeal was that it consumed less physical depth than free-standing pin setters -- a potentially desirable characteristic where square footage is at premium prices. It does make sense that it would consume less electricity, as there's no pin lifter that has to run continuously, but it never occurred to me that maintenance costs were lower (although I'd like to see numbers on this).

Yes, European bowling alleys have used string-based setters for a long time, but bear in mind that most European bowling is of the nine-pin variety, which uses much smaller balls and pins. Ten-pin alleys in Europe still use the free-standing pin setters.

And yes, the pin action is very different. The movement of the tethers against each other can pull down pins that otherwise would have been left standing. I witnessed this at least twice. And I can't imagine anyone picking up a 7-10 split with one of these things.

And maybe it's just me (and it probably is), but there seems a certain inauthenticity -- a certain chintziness -- to a string-based pin setter, like I'm playing with a cheap replica for kids rather than the real thing for grown-ups. ("Hey! Are you calling European nine-pins chintzy?" No, just... Unfamiliar. I'm sure there are whole schools of thought on how best to use the tethers to your advantage, and which tether materials are "better" than others. It clearly works for them.)

Comment Re:The Old Days (Score 1) 212

Anyway, point is, we had ads in our free content for about 50 years, and that's what paid for the content. We wished there were not ads, but it was part of life. And it was fine. [ ... ]

It was not fine. Everyone put up with it, because there was no other real choice, but it was not fine.

Even at the time, people correctly complained that the ad block model made certain kinds of shows impossible. Do you think a televised production of Death of a Salesman would have the same emotional impact if it got interrupted every 10 minutes to sell beer?

Ads infuriated me as a child, and the intervening decades have done nothing to improve my opinion of them. Indeed, I regard them as vandalism, litter, pollution -- unnecessary, unwanted, and destructive by their very nature. I hate them so much that.... I pay for YouTube Premium. I visit YouTube exclusively with Firefox, I have never witnessed this reported start delay, and I never am troubled with ads.

Slashdot Top Deals

In any formula, constants (especially those obtained from handbooks) are to be treated as variables.

Working...