Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
×

Comment Re:root = same process (Score 5, Informative) 130

Gatekeeper also isn't "all MacOS X security". There's separate malware detection, and in order to do much of anything the user has to enter their computer account password.

It's a minor part of OS X security, mostly designed to keep casual users from installing stuff outside the apple store.

Yes.

There's also Mandatory Access Controls (MAC Framework) in the kernel itself, and there's BSM secure auditing in the kernel itself, and there's discretionary access controls, such as standard UNIX permissions, and there's POSIX.1e draft (it was never ratified as a standard) ACLs, and then there's whatever malware detection or antivirus protection you've jammed into the kernel as a MAC module via a KEXT, and in the absence of any access controls whatsoever, it's default deny, and then there's code signing, and encrypted pages within executables.

They didn't bypass any of that, and they wouldn't really be able to, even if they were root, because you can't get the Mac port for the kernel virtual address space without jumping through a massive number of hoops (which is why jailbreaking phones is non-trivial, and everyone uses script kiddy tools to do it, instead of jailbreaking from scratch).

And yeah, it's pretty stupid that Gatekeeper or anything else would be running as root and thus be exploitable with the escalated privilege available at install time, since it'd be pretty easy to just have it run as a role-based account, and have the kernel's cooperation, after cryptographic verification of the developer keys at the kernel level. But that doesn't let you bypass "All OS X Security": getting root doesn't really get you nearly 1/10th of the security bypassed (less, if you've installed third party anti-malware KEXTs that refuse to be unloaded except in single user mode during boot as part of an uninstall script, and are therefore always active).

They clearly do not understand the concept of "security in depth".

Comment Personally, I don't think he was talking to Google (Score 5, Interesting) 349

Personally, I don't think he was talking to Google; at least not directly.

He got called by a recruiter, supposedly for Google, who set up a phone interview Looking for C/C++ and Java. Fine. There's an outside chance of Java, either as an Android App developer, or for some server back end crap at a company they purchased. It's unlikely, but it's possible (in 2011, they hired people to work at Google, and then groups decided to offer them, and then you got a choice of usually one of 3 groups... you didn't know what you'd be working on at interview time, and there was no such thing as "hiring for position" unless you were net.famous).

Then he didn't get sent a Google Docs link by the interviewer. You are *always* sent a Google Docs link by the interviewer, unless you are in a city/area where Google has a facility, then you are instead brought in to use the video conferencing at the Google location.

Then he got an interviewer who barely spoke English, and wouldn't take him off speakerphone. That never happens at Google.

The interviewer was 10 minutes late to the call.

Frankly, sir, IMHO, you got played.

You just got man-in-the-middled by an Indian or other foreign person who wanted a job at Google, and got you to ghost his or her phone interview for them, with the help of a "recruiter"/"interviewer" who had you on lousy speakerphone so that they could relay your answers directly via a cell phone to the person Google was actually talking to.

Yes, this happens.

No, savvy technical people generally don't fall for it, because they get an email from Google telling you the schedule, there's a Google Doc URL sent out with an @google.com address, and if you look at the email headers in the email of the schedule, you'll see that they are probably forged, assuming you got one at all.

Congratulations on being played, Mr. Robert Heath.

Comment Re:It's hard to credit the behavioural science cla (Score 1) 198

Which is probably why it's a good idea for the Feds to fund it instead.

Because if the feds fund it, and the research gets actual results we don't already know, Microsoft is going to run out and implement it and make the next version of Windows the same headache for themselves that XP has been turning out to be?

What does it matter *who* funds it, if no one implements anything based on the results (if any) of said research?

Scratch that... I guess it matters to currently unemployed behavioural scientists, although they are likely more concerned*that* it's funded, rather than *who* is funding it...

Comment Have to wonder if this has something to do with... (Score 1) 368

Have to wonder if this has something to do with the interposing https phased rollout by Comcast for their CloudFlare based CDN that they use for web acceleration to reduce their peering overhead. It was preventing me from getting to e.g. LinkedIn and Amazon.com for a couple of days, until they had the kinks worked out. I'm told that I was in one of the "early rollout areas".

Obviously, no one complaining about this gives ISP or other useful diagnostic information in their postings, so it's impossible to give them a good technical answer for their problems, since the problem statements are all lacking in technical information.

This may help; I'd suggest a rename, rather than a delete on the cache stuff, though - in case that's not it:

https://support.apple.com/en-u...

Comment Hipster alert (Score 1) 368

I've had iTunes since my Rio MP3 and I've never paid anything to an online music store, ever.

Do you think anyone really cares if you've never bought anything from an online music store? Do you think that makes you superior in some way? The term hipster is stupid and usually used poorly but I think it might apply here.

I buy my CDs and DVDs from the artist or band in person, then they get half of the money instead of 0.02 cents.

Those of us with actual jobs and real life obligations have better things to do than track down random artists in person so we can throw an extra $5 at them in person.

You old guys on slashdot have heard of podcasts, right?

And my hipster theory is confirmed. Do you have a point to make or are you just trying to be smug?

Comment Might want to check your facts (Score 1) 368

Funnily enough, the iPod which did not work as a removable HD is the thing that made me switch away from apple, some 12 years ago.

Just throwing this out there but you might want to actually check your facts before saying something publicly that can be shown to be completely false by spending 10 seconds on Google's search engine.

You've been able to use iPods as removable hard drives as far back as I can remember. I've done it myself.

Comment What is your alternative hypothesis? (Score 2) 171

Fracking has been going on for nearly 50 years.

But only fairly recently has it been employed in large scale in the relevant area. It wasn't economically feasible in lots of cases due to the availability of much easier and cheaper sources of oil and gas.

But now...NOW, it's causing earthquakes.

Apparently so. Do you have evidence of an alternative reason for earthquakes to go from 2/year prior to 2008 up to over 2/DAY in 2013?

I see.

So you are skeptical? That's fine. Have you looked at all the evidence and found a plausible alternative hypothesis we can test?

Comment Facts support themselves (Score 2) 171

Unfortunately this announcement comes from the executive branch of the US government.

So what? Either the facts support the claims or they do not. Who it is from is irrelevant to its veracity. There is a reason we insist that scientific findings be repeatable so that others may confirm the findings. The fact that a government agency is involved is irrelevant to the scientific process.

Many of us have developed zero trust in anything coming from DC.

So even if what they are saying is actually true, you plan to dismiss it out of hand because you dislike government in general. This in spite of the fact that you provided no actual reason to dispute the conclusions reached in the study nor any articulated reason to think the USGS is being dishonest in any way.

Comment Behaving as expected (Score 2) 171

You don't think the oil and gas industry hasn't spent millions of dollars to try to say that fracking is perfectly safe and couldn't possibly cause any harm?

Of course they have. You'd have to be living under a rock with your fingers in your ears to think otherwise.

Basically they've done what the tobacco industry did .. delay, obfuscate, and claim that it's up to someone else to prove it's dangerous while they assume it's safe without evidence.

More or less, yes this is exactly what they are doing. The playbook is almost identical. Claim that there is insufficient proof, ask for more studies (funded by them frequently), hire "experts" to promote their viewpoint, hire politicians to hinder any regulations, etc. Take the tobacco PR playbook, scratch out tobacco and write in fossil fuels and that is almost exactly what they are doing.

You don't think a massive lobbying, PR, and fake science campaign isn't an actual conspiracy?

I think it is a rather clear and unsurprising expression of economic self interest which in many cases is contrary to the public interest. I don't think you need to invoke some grand conspiracy theory to understand their actions though I would not be shocked to find out that there was some fossil fuel companies acting illegally in cahoots. Anything that makes it more expensive to drill/refine/sell, increases regulation or reduces fossil fuel use is likely to be opposed by producers of fossil fuels. They all know they basically think the same way on the topic so they're all behaving more or less as expected.

Comment Pathogens don't care about laws or government (Score 1) 616

You just love stating opinions as facts, don't you?

Sounds like you do too.

You will find a great deal of resistance to your views, because a great many people don't want the government telling them what they can and cannot do with kids.

I don't really give a shit about how people raise their kids until it starts to affect others, myself included. Don't want to vaccinate your kids? Fine. Go live in a shack in Montana and home school so you don't endanger the lives of others because you are squeamish about getting a very safe and effective vaccine against a serious and highly contagious pathogen.

You're probably one of those idiots who supports the one-child policy of China, aren't you?

I don't care much what China's government does and it's not really clear what they have to do with this discussion. That said if China want to make birth rates fall the best thing they can do is to improve their standard of living. High GDP per capita almost inevitably leads to falling birth rates. Don't take my word for it, the data is easily available to back me up.

Why don't you go live there if you love heavy handed government so much?

Tell you what. You explain to me how and why measles cares about a form of government and I'll concede the point. Last I checked, pathogens don't really pay much attention to governments.

Comment Reproducing should not get special tax treatment (Score 1) 616

He's not asking for special tax treatment. He'll still pay the same amount of taxes. He's asking that the government spend the same amount of money on his kids' educations.

Again, no. I don't have children and I don't get special treatment so why should he just because he chose to reproduce? Not my problem. Plenty of people don't have children but still pay taxes to support their local schools because it is a public good. An educated populace benefits us all. My education is long since finished and my parents still have to pay taxes to their local school district. In fact I actually went to a private school for good parts of my education and I can assure you that my parents did not get a tax break.

Slashdot Top Deals

In seeking the unattainable, simplicity only gets in the way. -- Epigrams in Programming, ACM SIGPLAN Sept. 1982

Working...