Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
×

Comment Re:Yeah, but... (Score 1) 498

At least it's analog.

Note: in reference to "back when the common storage medium was a cassette".

Cassette, floppy, hard drive, CD-ROM, VHS tape, punch cards, bar napkins and pencil ... they're all analog MEDIA that can store digital DATA. Shouldn't confuse the two.

Comment Easy to check/verify/stop in Safari (Score 1) 116

I normally don't go to URL shortener links at all, having long ago seen how easy they are to hid the real URL of suspicious sites. Also, I've been using Safari for years, and although Firefox is installed it's my preferred browser. Normally I have the download window and the activity window active on the right side of my desktop. The Activity window in particular is very handy for monitoring any and all surfing activity.

Similarly, I have been a long-time user of Little Snitch to monitor and authorize/deauthorize outgoing connections, with the network activity window always showing upon outgoing network activity. I suspected one, or both, of these tools would be useful.

Little Snitch, as expected, shows the network activity as a fairly constant level of network activity, but since it's an authorized outgoing connection (your web browser, naturally, has to be allowed to make connections to the usual internet ports like 80, etc, or no browsing for you) there isn't much that would really seem unusual. Many requests and deliveries of data are of course visible, but this is relatively normal and probably would not really alert anyone; for example it is similar to what you would see with a streaming server delivering content on a page. It's there, but it's not obvious something nefarious is going on unless you were really paying attention, and there's really no reason to be, since it's a standard browser operation, more or less.

Safari's Activity window, however, reveals the activity quite obviously. In a few moments using the sample page outlined in the original article, you see a huge amount of requests to the target url. A normal webpage might have up to 100 or even 200 different components, but not a constant stream that gets to 100 in a few seconds, and keeps going. The urls are fairly obvious as well, taking the form of:
http://www.example.com/?v=1292889926999 ...{continuous stream of ... example/com/?v= [some incremental number]} ...
http://www.example.com/?v=1292889877790

The webpage does not fully load, but the stream continues until you close the page { [Command-W] or mouse click on the close button }

With the Activity Window open you should be able to monitor and react to being an unwitting party to the DDoS.

Comment Not always worth the effort ... (Score 1) 343

In the wake of the Gawker exploit, we're seeing lots of news articles in major papers consulting "security experts" and the reporter then quoting or suggesting using more than 8 character passwords.

Of course, none of them mention that Gawker threw away any characters beyond 8, so that (for example) 12345678 was just as secure as 12345678%#^*(&^&(**, and entering 12345678 would allow both accounts access. I find it
hard to believe that others sites don't do similar things, and of course they're not going to tell you that (it's a security exploit clue) so there's a good chance that your attempt and effort is wasted anyway.

Don't get me started on sites that have so-called "security questions" which are a non-editable list of crap that anyone with a phone book or knows how to use Google can discover. My bank recently added a bank of 5 non-editable questions (although, they do give you a list of 10 stupid questions to select from) but my reasonably secure answers always failed a login ... creating and using the questions became mandatory one day, and I was locked out of my account in the meantime, with bill due dates looming.

Turns out that they limited the characters for all answers in total to less than 60; apparently they wanted short, one-word answers, and called it "good". It took two days and phone calls to both my bank and from them to their outsourced IT guys to figure out that little problem, but a few hours before they called me I had managed to figure that out myself in about an hour (it took about 5 minutes each attempt to login, wade, select and answer, record the answers, test, logout, count characters, login ... ). Even though they called later and told me 60 I had actually determined the limit to be 63, or 1 less than an average of 16 characters per answer.

Now, in contrast to your bank, low-value sites that require you to log in to comment, and where all you do is casually comment, don't deserve your time and effort to create and use good passwords, probably. Perhaps better advice is to create a throwaway eMail address in Gmail or some other free public eMail service, and have your mail program simply automatically delete every eMail from that address upon arrival in your inbox, eliminating the spam issue completely (for you). Use that eMail, and a correspondingly useless username and password, and don't worry about it. If you find later that you are going to actually use that site (ie by making a submission rather than just a comment) then reset or create anew with more secure credentials.

This is really a natural progression of the web itself; at one time you logged into sites that actually mattered, now every little crap site on the planet wants a login. If you follow that approach, you need to divide the expanse into what matters and what doesn't, keeping in mind that if you put one site into the "doesn't matter" category, then every site in that category can result in them all being compromised ... so be sure that it's appropriate and you don't use throwaway credentials in a site that matters; in particular any social networking site should have it's own unique credentials, since "Sharing" is their middle names.

Taken in this light, it's also a corollary to the (not unreasonable) revelation that a lot of the usernames and passwords were low-value security-wise on Gawker. I mean, I understand that crap passwords are an irritant to IT Pros, but we all only have so much time. Maybe some of those users actually have the password thing right and do have good security in mind; just not for a site like a Gawker Media site. Of course, it appears the principals and staff of Gawker aren't in that category, since their credentials themselves should have been good practice examples.

I realize that IT pros who actually know what they're doing might cringe at the idea of deliberately creating insecure passwords, but we all have lives to lead and time to allocate, and as the Gawker Media incident shows, not everyone who should care actually hires competent IT staff in the first place. My username (according to the Salon tool) was compromised but not my eMail or login, so apparently my 8-character was good enough, maybe. But you can't help feeling like an idiot when you learn that you've been entering a decent password manually (never allowing the browser to store it) and the site just throws half of it away. That can't be helping the effort of those who do have a clue and sites that actually have reasonably secure procedures in place.

Comment Re:Is this even a story? (Score 1) 288

People tend to assume things work elsewhere the same way they do locally or nationally. Reality is detention, arrest, being charged with an offence, and all the other aspects of due process vary widely, even amongst countries that are considered good examples of due process.

I often hear or read about stories where, in the US, someone is "held for questioning" for a period of at least multiple days. I have to admit I have no idea what the practical legal details involve ... the point being it's not important to someone who lives elsewhere. Where I live, Police can't hold you any longer than, in practical terms, overnight, since they have to either lay a charge or release you by morning; there is no legal provision to hold someone any longer than is required to bring you before a judge ... Police cannot hold you without laying a charge; you can demand to be charged or released immediately at any point.

But I would be foolish to think that same rule holds elsewhere. There are subtle differences in meaning from place to place when the news reports someone is being detained or charged, there are different rules regarding who can and cannot be held and for what reason, there are different rules of disclosure required.

As for there being a public record of someone's arrest, I'm pretty sure that you will find Police almost anywhere are not required to say anything they don't want to say; what public disclosure is required will probably be based on habeas corpus; in other words the only mandatory public record might be the first appearance before a judge or justice and not before.

Comment Interesting, but not particularly new or unusual. (Score 1) 298

This is interesting, in a "new fact to file away and ponder much later" but in no way new. Modern naval ships have had this type of technology for a very, very long time. By way of example, one of the more modern Frigates in the world, first deployed in 1990, can continue to acquire (via Identify Friend or Foe transponders, or IFF, which everyone uses and have for ages, plus various aggression-identifying logic systems), track and attack targets under a full combat level of alertness even if all personnel on board are dead.

Within the next 10 years practically every navy in the world will have this type of system in place; the only ones who currently do not are those whose ships are more than 20 years old and for whatever reason, could not upgrade the command-and-control system in the meantime.

Comment Solving a problem that does not exist (Score 1) 968

Call me crazy, but I occasionally type with one finger while doing two things (one of which involves the KB) and the Caps Lock key is invaluable there, even for typing just one uppercase character. I do think that's something netbook users are going to want to do as often, if not more often, than, for example, traditional larger laptop users ... similarly I like to spell properly, so I'm going to want to type DELL instead of dell, USPTO instead or uspto, and so on. I also use Caps Lock on my smartphone while texting ... where yelling is often appropriate, not simple bad behaviour in a forum post.

The offered reason to remove the Caps Lock key is commendable ... saving users from themselves ... but isn't it easier to just correct bad behaviour with another post from a different user ... which is practically guaranteed to happen, in my experience ... than to take a useful tool away from everyone, including those who actually know how to use it?

This is the kind of "dumbing down" where everyone pays; I'm not in favour of it at all. It joins a long list of things we are being forced to do to help the functionally lesser members of our society, like Anti-Lock Brakes, which is fine if it's defeatable in a car but a pain if it's not (and if you can't see a situation where ALB is a hinderance to safety or control let's just agree we don't drive in the same places under the same conditions, and you can leave it on all the time).

Comment Re:Yawn (Score 1) 333

I suppose I could have been more specific. I'll put it this way: the principal method ordinary soap uses to protect us is by allowing the bacteria to be washed away with water. The number that may die from other effects is significantly smaller and in essence incidental.

Soaps have a detergent action but proper hand soap is quite mild. Few people wash their hands with dish soap; it's a different formula entirely than Ivory bar soap (for example).

As for soap contributing to superbugs, its true that the specific agent in the OP, triclosan, don't work in the same way as others. None the less, those other agents are in the common antibacterial soaps and are part of the problem with regard to superbugs.

Hot tip: if it's labeled as a "deodorant soap" it's got antibacterial agents in it. The Irish Spring formula existed long before triclosan was used in such formulas. The original Deodorant Soap used carbolic acid and was marketed 100 years ago.

Comment Re:Yawn (Score 4, Informative) 333

'Antibacterial' soap kills almost no bacteria that regular old soap doesn't. It is a marketing term that means nothing in the world of reality because soap itself destroys most strains of bacteria on contact. Therefore, this is something more going on here than just "not enough germs weakens immune system". ...

Not true, actually. Soap simply breaks the bond between your skin and the oils your body produces. These oils are what prevents plain water from washing away bacteria.

So, washing with ordinary soap washes away bacteria; it does not kill them.

Antibacterial soaps do kill many of the bacteria, while also washing them away (as it is, after all, soap). By antibacterial soaps we are talking about products like Irish Spring; by ordinary soap we are talking about products like Ivory bar soap.

No antibacterial agent (that you can safely use in the home) kills 100% of the flora it's exposed to, and no soap washes away 100% it's exposed to.

Your body needs some types of bacteria to be healthy; as does your own skin. You don't really want to be killing helpful bacteria; you are less healthy as a result, but antibacterial agents are non-discriminatory. They kill the good with the bad. So, there's one problem with antibacterial soaps.

With ordinary soap, you wash away a large amount of bacteria but helpful bacteria remain in enough quantity that they can reproduce and do their helpful job.

Also, bacteria are able over time to resist agents deployed to kill them. So, if you use antibacterial soaps where ordinary soap would do, you end up with "superbug" infestations, like ordinary staph bacteria that morphs into aggressive agents that infect wounds in hospitals and are extremely difficult to control. There's the second problem with antibacterial soaps.

Use ordinary soap, wash as often as required, and live a healthy life. It's not complex.

Comment Re:Embarassing? (Score 1) 360

I did not once mention the SEC. Of course the transaction is legal.

I'm talking as an investor. I play with my own money and I've learned some lessons along the way. An investor who does not perform due diligence when trading gets what he deserves.

I can assure you I never trade without checking the [perfectly legal] trading activity of insiders. This is stock market 101 stuff.

Comment Re:Correct me if I'm wrong (seriously) (Score 1) 741

Good points, all, but I think you missed a thing or two.

The Japanese justice system has something like a 95% conviction rate. Virtually every single charge comes to court with a signed confession.

Call me crazy, but there is something suspicious about all that. I don't think Americans are going to support that level of ... how would I put it ... investigation ... from the police.

And if they did, I'm sure they would show it by demanding it starts with the necessary changes to the Constitution to enable it. Which is pretty much the exact opposite of what I'm reading in the comments here.

Comment Re:Expensive Price (Score 1) 437

Low volume price sounds about right. Might come down with higher production, but for that you need volume sales.

It's got to use basically the same chips as every other phone, because they are integrated ... the features are built into the chipsets necessary to make something that will work as a cellphone, but not enabled. I very much doubt you could buy a chip that only makes calls from any fab, and even if you could, it would probably cost more than the chip they're using.

These guys are not Motorola/Nokia/SONY Erickson/etc. Probably sounds expensive as a non-subsidized price, but the chances of any carrier actually selling this phone are slim to none; they make too much money on the non-phone-call features, so it's not going to be the cheapest phone available no matter what.

Comment Re:Embarassing? (Score 1) 360

[Missed my footnote] ... but it also means no money for renewable energy, no farm subsidies, no foreign aid (1) ..."

(1) Foreign Aid is always money transferred from taxpayers to corporations or citizens. When the Federal Government offers Foreign Aid to another country, what really happens is the Government spends all the money on US jobs and products. If it's food, they buy the food from US growers and give that away. If it's technology or some building initiative, all the companies involved are US companies with American employees. If it's development aid, they hire US citizens to do the liason. If it's military aid, they buy the planes from Boeing or weapons from Raytheon and then give them to the foreign government. Foreign Aid is simply just another government transfer to Americans.

Comment Re:Embarassing? (Score 1) 360

" ... Socially liberal does not mean "spend money".

Any other definition necessarily requires taking my money and giving it to someone else. ..."

Libertarians do have a political philosophy that straddles Democratic and Republican party lines. This is somewhat complicated by the fact that neither Republicans nor Democrats follow either liberal or conservative political philosophy strictly; each borrows some from both, despite which brush people tend to paint them with.

Libertarians support lowering taxes, eliminating taxes, and would be against any new taxes. If that sounds Republican, note that they would also support eliminating government programs and spending on anything except essential services. That might mean no welfare, no unemployment insurance, no spending on drug rehab centres, but it also means no money for renewable energy, no farm subsidies, no foreign aid (1), and get the Defence Department out of the highway building and waterway dredging business. Let the airlines and passengers pay for the airports, let the sports teams pay for the stadiums, let the universities fund their own research.

Socially, there is really no difference ... it's "get government out of it" again. No restrictions on who can carry guns, no speed limits, no meddling in abortion debates or stem cell research, no teacher led school prayer but no restrictions on individual student religious expression. No DRM legislation, possibly no or very limited copyright and patent law. Let the gays in the military if that's what they want to do. Whatever, as long as it doesn't infringe on others rights to security and enjoyment of private property.

In other words, smaller government, period. No exceptions.

I'm not sure where the Tea Party fits in all this ... they started out acting Libertarian but then the issues started coming up and many of their answers were just regular Republican policies rehashed a bit.

The Republican Party supports spending on areas that Libertarians would be stridently against, just like they would be against most Democratic spending initiatives.

Slashdot Top Deals

"No job too big; no fee too big!" -- Dr. Peter Venkman, "Ghost-busters"

Working...