Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Comment Re: worse a fake root certificate! (Score 2) 248

Is there a way for sites to detect and block this?

No. The host is compromised.

Even if the bank mailed you a copy of their real cert, the compromised host could just update the malware to fetch the real cert and display that when the user tries to view the cert's details.

Even if the bank handed you a copy of a UNIQUE cert they use for ONLY for you, IN PERSON, and you handed them your own UNIQUE client cert, the compromised host could just watch all the legit shit happen when you log in the first time, then fuck you in the ass with that legit information.

Even "2-factor" authentication with a RSA clock won't help - these codes are good for a window of time (to allow people time to enter them and to allow for latency, clock skew, etc.). A compromised host can just use the same valid code rapidly within that window. Some systems require you to enter two distinct codes for a transaction, but this doesn't solve anything either as a compromised host can just trick the user into thinking they're moving $100 into their account when the real transaction is moving $10000 into the attackers account.

True one-time use keys don't fix this either.

Comment Re:Is javascript dangerous? (Score 1) 125

It seems that javascript is a common factor in most malware infection mechanisms. Is there a way to make javascript safe?

0: Don't write and host your own malicious javascript.
1: Don't host third-party javascript.
2: Don't host third-party content without sanitizing it to ensure it doesn't cause users to load other third-party shit.

1 & 2 can be combined into a simpler, more secure rule: Don't host third-party content.

Comment Re:The modern web runs on javascript (Score 2) 125

It's a fucking recipe for a pork roast.

It doesn't need to be anything more than HTML and images.

What if I want to convert to/from metric units? With Javascript I can click a button and have the page change all the values. Without Javascript I'd have to click a link instead!

What if I want to adjust the number of servings? With Javascript I can type in a value for servings and have the page tell me I need 2 and a half eggs. Without Javascript I'd have to type in a value and then hit the Enter key or click a Submit button!

What if I want to read user comments about the recipe? With Javascript, I can click a "Show Comments" "link" and just wait for the page to load comments. Without Javascript I'd have to click a "Show Comments" link and wait for the page to load comments!

What if I want to rate the recipe? With Javascript, I can give it a thumbs up or thumbs down, or give it 3.5/5 stars or little chef hats or whatever cutesy icon they want. Without Javascript, I'd have to click a button or use a drop down!

Comment Re:someone explain for the ignorant (Score 1) 449

That's all avoidable by GPs "reasonable protection from the owner".

I wouldn't deal with the police at all. I'd deal with my card issuer. (They could design the scam this way, but I for one would be going to my card issuer's website and contacting them via whatever shitty webform they have.)
I wouldn't believe the card issuer would hand deliver a new card to me.
I don't think I've ever had to tell a rep my pin.
I would never hand my old card in to some courier, I'd destroy it.
I would not be reusing my pin.

Comment Re:someone explain for the ignorant (Score 1) 449

The thing I don't like about it, is on the signature block on the back of the card I just write check id

Massive FAIL there, Psyko. If your card is ever stolen, instead of the CC company being responsible for losses you are!

Wrooooooooooooooooooooooooooooooooooooooooooooooooooooooooooong.
An unauthorized charge is an unauthorized charge and you are not liable for unauthorized charges.

Comment Re:no (Score 5, Informative) 105

SCSI over USB only really adds queuing, improving speed when many small reads/writes are performed, and you'd need an SSD supporting SCSI and an enclosure/adapter supporting SCSI over USB. Further, for large transfers plain USB 3 is just as fast, while having the benefit of being cheaper, and more readily available and compatible than SCSI over USB. Of course, straight SATA III (via eSATA if you want) is still faster.

USB 3 gets you 5 Gbps and has to be handled by the CPU.
SATA III gets you 6 Gbps without going through the CPU.

USB 3.1 promises to get you 10 Gbps (and lower overhead), but still has to go through the CPU.
And Thunderbolt is just a convoluted and expensive way of piping a limited number of PCIe lanes to a random physical port and requiring the user to buy an expensive cable. 10 Gbps or 20 Gbps. 40 Gbps in the next revision.

SATA Express / M.2 can get you 32 Gbps using 4 PCIe 3.0 lanes or 2 PCIe 4.0 lanes wrapped up in NVMe.
And you can always just throw more PCIe lanes at some controller (on-board or an via a PCIe slot) or some device directly if you want more bandwidth.

USB 3 will be the standard for external shit for a long time. The C connector and USB 3.1 are going to have a hell of a time gaining traction.
For people who want performance, SATA Express / M.2 using NVMe or other direct PCIe solutions win.

Comment Re:Co-Conspirators? (Score 1) 188

He knew that his Job was illegal, and he was making money for that. So dont be so naive. If you do a Job that something is fishy is up to you to continue

I'd like to see you trot that out the next time a cop or TLA employee is caught doing illegal shit as part of their illegal job duties and no one suffers any consequences.

Slashdot Top Deals

The game of life is a game of boomerangs. Our thoughts, deeds and words return to us sooner or later with astounding accuracy.

Working...