Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×

Comment Um...is the story true at all? (Score 1) 352

Right now, the page at https://www.cdc.gov/coronaviru... lists "People who have had close contact (within 6 feet of an infected person for at least 15 minutes) with someone with confirmed COVID-19" as a consideration for who should get tested. I don't see any reversal here; it looks like the CDC still wants you to get tested if you've been exposed.

Comment Re:It may be possible, but we're not up to it (Score 1) 232

I call BS on this, and even on your so-called credentials. "A lead cryptographic security engineer on the world's largest operating system" -- you do crypto for Minix?

Android. You think Minix is the world's largest operating system? I guess I should have been clear that by "largest" I meant "most users".

Given a quick lookup and your comments below, I apologize. When I hear such high and broad claims like I quote above, I'm used to that being someone BSing. I now believe that you are the real deal.

BTW, the "Minix" crack is pointed at Intel, who had it running on every Intel Management Engine, thus making most Windows, Mac, and Linux users into Minix users by default. Thank you folks at Google for finding that one, BTW.

Once law enforcement has access to backdoor keys

Certainly, which is why it would be crucial not to give the keys to law enforcement. Perhaps the courts should hold them. Even better, there should be a multi-party access control system, so that court officials, law enforcement officials and probably the device maker all have to agree before the keys can be used... and even then the actual key material should live in secure hardware that will never divulge it, so the multi-party access control only provides temporary use of the keys. The access control and key security are a big parts (but by no means all) of the ridiculously-hard key management problem.

You know better than I do whether that is technically feasible. However, the government isn't even asking for that, to my knowledge. They're asking for a backdoor and haven't said anything about how they intend to keep that back door locked. We've already given them a back door in another field -- TSA-approved luggage locks -- and they have shown poor responsibility even with those. TSA keys are available on the black market, and the TSA helping themselves to your personal belongings is a standard problem these days.

Comment Re:It may be possible, but we're not up to it (Score 3, Insightful) 232

I call BS on this, and even on your so-called credentials. "A lead cryptographic security engineer on the world's largest operating system" -- you do crypto for Minix?

Once law enforcement has access to backdoor keys, those keys are subject to rubber-hose cryptanalysis and just plain bribery. One dirty cop or judge, or one honest cop or judge with a loved one taken hostage, and the keys are out. In other words ,"secure back door" is an oxymoron.

Adding a back door is trivial. Public-key crypto systems like those used in SSL can be encrypted in such a way that it is decryptable by one of several private keys. To add a back door that law enforcement can use, just make one of those keys the matching public key. The algorithms don't even have to change.

Keeping that back door secure is impossible. That private key would then be worth multiple billions of dollars to organized crime, terrorists, or similar folks. With such motivation, it is easy to attack the humans in the system through bribery, torture, or extortion. Once that is done, everything from your local credit union to the NYSE is pwned by the mafia, Al-Qaida, or whoever.

Comment Re:Sheeple (Score 1) 216

A working definition of chutzpah is killing one's parents and then begging the court for mercy because you're an orphan.

Apple is in the business of getting people addicted to their devices. And then they put the people who are doing that into a building with glass walls. Apple is creating its own problem.

Heck, that even got me to change my sig line...

Comment Re:I'd want to know, too. (Score 5, Insightful) 111

If they're sharing the code with everybody, that's good engineering practice. This raises the possibility that a White Hat will discover a bug and report it to the vendor, who can then close the hole.

If they're sharing it with only Russia, this puts them in a privileged position to exploit those bugs without reporting them. Clearly, this increases the odds of a breach. This isn't because it's Russia, either; sharing with any one entity, unless you absolutely trust them to report all the flaws they find, causes the same problem.

Comment Re: permissions (Score 1) 324

There is one profit center in a company. Not engineering, not marketing, not even sales.

It's called Accounts Receivable.

All those other departments are cost centers whose only goal in life is to convince customers to pay the bills that Accounts Receivable sends out. If a department can't get people to pay more money to Accounts Receivable, it isn't only a cost center, it is a loss center and should be gutted. However, one must note that any department (such as legal or compliance) which is even the "cost of doing business" is helping Accounts Receivable to get paid on any bills at all.

So, enough of this cost and profit center nonsense.

Comment Re:Business (Score 1) 274

The worst part is, most publicly traded corporations are effectively psychopathic, as enforced by law.

Look up Dodge vs. Ford Motor Company. In short, the company has but one moral: to satisfy the shareholders. And unless you have a very special group of them, they want profits. Thus, a publicly traded corporation has the one moral of "make more profit" and any other morality goes by the wayside.

And if corporations are people, then they are giants in terms of what they can do. So we live in a world full of psychopathic giants that are naturally immune to criminal law.

There's got to be a David Lynch film in here somewhere.

Comment Depends on your learning style (Score 1) 312

There are many ways to become a programmer, and you'll hear most of them here.

First off, what kind of programmer do you want to be? Nobody knows everything. Do you want to be the guy at the office who can make spreadsheets sing? Some have said that Excel is the world's most popular language. Do you want to write web games? Database stuff? Hardcore number crunching?

Do you think that you will learn better studying theory, listening to lectures (YouTube is your friend), or just going in live without a net and hacking things until something blows up?

If you want to learn theory, there are two obvious directions (and likely more). C and C++ make you think like the machine; they were built for writing operating systems in, so they are "close to the metal". The languages are the racing cars of programming: incredibly efficient, able to do amazing things, but no automatic transmission, power steering, or ABS breaks. One false move and you go head-on into a wall. Lisp makes you forget about all the silicon and concentrate on abstraction: the more you understand abstraction, the more that any given problem looks like something you've done before and therefore can do easily again.

If you want to learn by playing, Python is considered a good language for that. Java may also be a good language; it's very strict, which means that your compiler or even your editor can catch a lot of bugs before you even try to run the program. Grab some code from online, make yourself a little sandbox where you can't hurt anything (like trashing your employer's database), and tweak it. Run the program, decide to make a change, and look through the code to see how you might do that. If you want to write code, you're going to have to read it, after all. Use some sort of source control, even just tar or zip file backups if you don't know source control, so that if you go off into the weeds somewhere, you can come back to someplace safe.

Choose your first language based on the way you want to learn, not on the language you want to learn to program in. Learning new languages is easy; the basic problem in programming is taking what you want to accomplish and explaining it so well that even a chip made of sand can't get it wrong. Once you get the hang of your first language, the second one will be much easier, as you'll understand the higher level elements of what you're trying to do and just need to translate that into new words.

Comment Re:FDA approval? Why? (Score 1) 20

This comes under FDA jurisdiction because it is a medical device: something to help disabled people with their disability. Segways aren't medical devices, they're transports for able-bodied people. The precursor to the Segway is the iBot, a wheelchair which can balance on two wheels, climb stairs, and raise its occupant to standing height. That used to be an FDA Class III medical device, recently reclassified as an FDA Class II medical device. For that matter, all wheelchairs are FDA regulated medical devices.

As a medical device, the FDA is supposed to see how likely it is to harm you. If that device fails (batteries die, software crashes, wire shorts out...), your legs go limp and you fall. Especially in the elderly, falls can be fatal. Also in the case of a paraplegic, they want to make sure that it doesn't exceed your own range of motion and injure your legs, or pinch and draw blood (which you wouldn't feel because of the paraplegia), or who knows what else.

"FDA regulated medical device" and "available by prescription only" are not the same. Bandages are FDA regulated (they want to make sure that those things truly are sterile), and they're available at 7-eleven.

Comment Somewhere in the middle (Score 1) 490

On the one hand, there is a lot of argument that the population is too ignorant and/or easily swayed to be a proper voting block. On the other hand, we see the cronyism and corruption which the current system gives. I propose a middle way.

First, to eliminate the effect of votes cast by people who really don't care about an issue: give every registered voter a million "votes" per month. If you are hard-set on one issue, you can apply all million votes to that issue, but you don't get any say in any other elections that month. If you care about ten issues, you can apply 100K votes to each one. Now there is an incentive to shut up about issues you really don't care about and/or understand.

Regular people make lousy voters because they aren't experts in government. I'm sorry, I'm a software engineer, I don't know the right foreign policy to implement in Freedonia, or just how many tactical bombers we need to purchase. Having representatives can be useful because they can figure out the answers to these questions as their day jobs as we go about our lives.

So we allow for representatives. You don't elect a limited slate of them for two or six year terms. You "elect" as many as you want every month. Basically, you implement a way to hand your votes to somebody else. So you are a strong anti-terrorist who wants to send more funds to antiterrorism efforts. Larry the Antiterrorist feels the same way, and sets himself up as a representative. You decide to send him 50K votes a month. Every month, you can check the public record (which doesn't record how you spend your own votes, but does record how you spend votes given to you), and verify that Larry is in fact spending your votes on antiterrorism elections and not on, for instance, the Interstate System. Even if Larry is being paid by lobbyists, you can see exactly how he's voting, and can take your votes away from him next month if you no longer trust him.

There are clearly other problems, including the ability to make such a system crack-proof. I wouldn't try to foist this on the Federal Government to start with; there are too many ways that this could fail that we can already think of, and ways that this could fail that we have no clue about. Try this at a municipal level first: small towns, small cities, big cities. If it bombs out, go back to the previous constitution or by-laws. But test this thing out before putting an entire nation on the system.

Comment Re:America, land of the free... (Score 1) 720

My last two companies (a credit card processor and a medical R&D facility) both did criminal background checks and credit checks. Besides the basic recidivism issue, they also want to make sure that you don't have anybody trying to _get you_ to commit a crime. If, either of those companies see too much outstanding debt or a known gambling problem, they might worry that you are dealing with a loan shark, thus organized crime, thus there's a risk of your being coerced to steal some juicy paydata (credit card numbers for the former, new product plans for the latter). If, on the other hand, it's a marijuana charge, there are some areas where they can't hire enough techies if they screen people like you out.

Do whatever you can to convince your future employer that you have no reason to steal from them. If you got grand theft auto for a college joyride, let them know--don't make them guess that you're in organized crime working for a chop shop. If you did get involved with the Mob or something, you're probably out of luck. IT requires that employees have access to juicy data, so it's more uptight than most about things like this.

Slashdot Top Deals

The biggest difference between time and space is that you can't reuse time. -- Merrick Furst

Working...