Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
×

Comment Re:Distributed versus vertical. (Score 1) 249

Google's model is to tie their platform to their other platform. The Google Play apps and the Play Store must be installed on Android systems for them to be called Android. All of those tie back to Google.

While Microsoft might get into hot water for tying back to their desktop exclusively, they have apps for iOS and for Android. They have Outlook.com, Exchange, Visual Studio (which can make phone apps!), Office for mobile, Sharepoint, etc that they can push.

While you're saying they won't succeed, that's not the same as saying that what they want to try is the same as what Apple's doing. Giving up most of the Nokia hardware business means they've given up on the vertical single-source solution pretty thoroughly.

Comment Re:The converse (Score 3, Informative) 59

I'm not a meteorologist, but this is my understand: It depends on the size and temperature of the particles, and potentially on their shape and concentration. If the particulate matter is too hot and in the air too thick, not enough water vapor condenses on each to form droplets heavy enough to fall.

I think what they are saying in this case is once the particles cool and thin a bit, they end up carrying that moisture with them until the condensation is complete. Hitting a mountainside and mixing with the cool air above is a perfect trigger to release the rain.

Large rain events often happen when a warm, wet mass of air mixes with a cooler, dryer mass of air that can't hold that level of moisture. The particulate matter is just one of a number of variables.

Comment Re:Microsoft tried the wrong business model (Score 1) 249

Distinction without a difference, really? Do you think Apple has a healthy ecosystem of devices that only includes first-party devices? No. Apple has only first-party devices. You can't buy an iOS phone from a non-Apple source. Google has the Nexus but the vast majority of Android phones are from other vendors. That's what a software company calls a "healthy ecosystem".

Basically the announcement reads "We want Windows Phone to be delivered the way Windows on the PC always has been: by every OEM out there".

Comment This isn't Apple envy. This is Google envy. (Score 1) 249

"We are moving from a strategy to grow a standalone phone business to a strategy to grow and create a vibrant Windows ecosystem that includes our first-party device family,"

This isn't Apple envy. They didn't say they want to focus on one offering. They said they want a vibrant ecosystem that includes their first-party devices. They've learned that when you're making the bulk of your OS's phones yourselves, there's little incentive for competitors to license your software. However, if you make a reference model, or maybe a couple for different market segments, and license cheaply and liberally, then you can really grow the influence of your OS.

Microsoft successfully killed any relevance Symbian still had. They killed Meego. Firefox and Ubuntu are still on the horizon. They didn't kill Android of course, and won't at this point. iOS is another juggernaut. MS wants to play the game Google has been playing, because they won't beat Apple at theirs.

Comment 'Coolest' mistake ever (Score 1) 377

A co-worker of mine had just finished implementing a new caching system for a legacy app that interfaced between multiple systems and the mainframe to track progress and shipping of pilot production runs. Due to a bug in his code, in a very specific use case, one of the cached systems would not get flushed. This was identified a few days after the production release when the company (a multi-billion dollar food sciences multi-national corporation) received a phone call from a Pastor in BFE, Minnesota asking why we had sent him almost 500 gallons of ice cream. Apparently, his church's address was in the system from some charity event we had sponsored, since the ID and business type didn't flush from the previous transaction, when the pilot plant told the software to print labels for the next order, it pulled the shipping address from the wrong database and the ID just happened to collide.

The cost of shipping the ice cream back for disposal was ridiculous. So the company told the Pastor to have a huge ice cream social.

The responsible developer was not fired, but there were running gags about him being the Ice Cream Man for the next year.

-Rick

Comment giant machines are US culture, and world culture (Score 3, Interesting) 107

In the US we love big machines. The Queen Mary, the Spruce Goose, the continuous asphalt pavers, the Liebherr T 282 B giant dump truck (although Liebherr is a Swiss company), the Boeing 747-400 and Lockheed L-1011 wide-body passenger jets, the massive Abrams tank, the Nimitz-class aircraft carriers, the 280mm towed howitzer M65 "Atomic Annie", and such are examples.

See how I slipped a Swiss-built monster in there? Well, the US and Japan aren't the only ones. Germany has a 31 million pound excavator. The largest plane is made in Russia by Antonov. South Korea builds some of the biggest cargo ships.

So while, yes, giant robots are a big thing in Japanese art the urge to build huge machines is all over the industrialized world. The US and Germany have never been afraid of large engineering feats. The US has a whole industry of using remotely piloted craft for actual combat.

I don't think Japan needs to focus so much pride on this one little competition as a cultural identity issue. It's not like a US firm is going to enter a contest designing and building a robot with the intent of a face-saving loss or an honorable tie.

Comment Re: There are a few options. (Score 1) 212

"Career" is still hyperbole. A project may fail. It may even be one job at stake. It wouldn't end a career.

So, assuming a make-or-break project for an employer are the stakes, here's what I'd do. First, I'd do an initial evaluation whether doing this on Linux is actually worthwhile given the alternatives on other Unix platforms. Second, I'd pick something for safety over performance. Given the budget, I'd pay for development on one of the OSS versioning filesystems to do clustering or one of the OSS clustering filesystems to do versioning.

I'd probably check to see if frequent snapshots are valid rather than per-file per-write versioning. That turned out to be the case in this thread. That gives many workable and fairly conventional options on Linux.

If per-write versions were really that important, and it really had to be on Linux, and really had to be shared as well, I'd probably alter my application to write through git libraries at the application level. If not git, then maybe Mercurial or Bazaar. If I didn't have control over the application, I'd look into inotify to do commits based on those writes.

If it really needs to be in the filesystem, really needs to be on Linux, and really needs to be per-write versions, I'd use something like NILFS2 on LVM with a SAN-backed LVM, and have read-only access shared out over NFS or CIFS.

No matter what I chose as my primary target, I'd choose a couple other alternatives and test the hell out of all three. I wouldn't greenlight anything for production until I was happy.

Really, if your employer expects anything less stringent on their production infrastructure than a full testing and development cycle and blames the implementors for failures of overspecified and undertested software as ordered by management, then you want a new employer anyway.

Comment Re:Type 4 UUIDs (Score 1) 251

My concern is how to keep someone between your server and the subscriber's MUA from compromising "possession", or how to establish "possession" the first time.

If you follow the same model with account creation, then you already have possession established. If someone compromises your email account, and knows your user account for this site, and knows your security answers, then yeah, you're borked. But if someone has all of that information already, I'm pretty sure you've been borked for a while and in significantly worse ways than someone having your college transcripts. ;)

I just use a PRNG. If I need it as a GUID, I request 120 random bits and format them as a type 4 UUID. Is that good enough?

"Good enough" is a question that is best answered by the asker. Security isn't a Boolean implementation. You aren't secure or insecure, you are at some level of security across a very wide range. Storing passwords in clear text is vastly more secure than having no authentication on a system at all, but it is vastly less secure than storing a hashed password. And that is vastly less secure than storing a 1-way hashed password. And even that is meaningless if you don't have a secured communication layer, or if you aren't correctly exchanging public/private keys. etc...

Are you trying to keep script kiddies from spamming your content management site with pictures of dicks, or are you trying to keep banking details, SSNs, and credit histories locked up with controlled access via the internet?

With that said, you're likely more on the 'secure' side using a v4 UUID, assuming the rest of your implementation follows the appropriate patterns.

-Rick

Comment Re:Responses (Score 3) 251

[quote]So how do you encrypt this UUID?[/quote]

You don't. It's just a GUID or some other low collision rate hash.

[quote]And what do you send for a password reset?[/quote]

You send them a new UUID in a link. When the link is hit, the UUID resolves back to their account and they are directed to enter a new password, just like a first time user.

The combination of time (the UUID can be time boxed), activity (a successful login nullifies the UUID), and possession (control of the account's registered email address), and if you want to get really wild, knowledge of a security question, creates a scenario where there are no good purely technical solutions for the attacker.

An attacker could, in theory, create a colliding GUID for an account they know the name of (but not password), manually enter the UUID link, and set the new password (assuming there is no security question).

But if an attacker manages to consistently generate colliding GUIDs*, they have accomplished something so monumental that they should be heralded as the second coming of Steve Jobs or something.

(*Assuming the coders didn't decide to come up with their own GUID generation algorithm that is easily reverse engineered and seeded)

-Rick

Comment Wierd, indeed (Score 1) 2

If it's Ubuntu, it's a new problem, or only affects certain makes and models. I ran kubuntu on an Acer notebook for quite a while, and its wifi was far better than Windows.

I suspect it's an issue with drivers; Linux has had driver issues in the past, especially with newer equipment.

Comment Speed is indeed important (Score 1) 6

Not everyone has a brand-new computer; The manuscript of the book I'm about to publish is in Open Office Word, about 400 pages and full of large images, and autosave is a real pain because it takes minutes to save the file.

Like another commenter said, I wouldn't make it the most important thing, overall efficiency is. But software speed is important to anyone with an older computer, especially a Windows computer, because the computer slows as the registry grows, and the registry never gets smaller, only bigger.

Security

Amazon's New SSL/TLS Implementation In 6,000 Lines of Code 107

bmearns writes: Amazon has announced a new library called "s2n," an open source implementation of SSL/TLS, the cryptographic security protocols behind HTTPS, SSH, SFTP, secure SMTP, and many others. Weighing in at about 6k lines of code, it's just a little more than 1% the size of OpenSSL, which is really good news in terms of security auditing and testing. OpenSSL isn't going away, and Amazon has made clear that they will continue to support it. Notably, s2n does not provide all the additional cryptographic functions that OpenSSL provides in libcrypto, it only provides the SSL/TLS functions. Further more, it implements a relatively small subset of SSL/TLS features compared to OpenSSL.
Privacy

Surveillance Court: NSA Can Resume Bulk Surveillance 161

An anonymous reader writes: We all celebrated back in May when a federal court ruled the NSA's phone surveillance illegal, and again at the beginning of June, when the Patriot Act expired, ending authorization for that surveillance. Unfortunately, the NY Times now reports on a ruling from the Foreign Intelligence Surveillance Court, which concluded that the NSA may temporarily resume bulk collection of metadata about U.S. citizens's phone calls. From the article: "In a 26-page opinion (PDF) made public on Tuesday, Judge Michael W. Mosman of the surveillance court rejected the challenge by FreedomWorks, which was represented by a former Virginia attorney general, Ken Cuccinelli, a Republican. And Judge Mosman said that the Second Circuit was wrong, too. 'Second Circuit rulings are not binding' on the surveillance court, he wrote, 'and this court respectfully disagrees with that court's analysis, especially in view of the intervening enactment of the U.S.A. Freedom Act.' When the Second Circuit issued its ruling that the program was illegal, it did not issue any injunction ordering the program halted, saying that it would be prudent to see what Congress did as Section 215 neared its June 1 expiration."

Slashdot Top Deals

Happiness is a hard disk.

Working...