Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×

Comment Re:iptables (Score 1) 349

Assuming the root ssh is blocked, how brute force can work without knowing the login name to apply the password to?

Simple: brute force the username. The username is just another part of the password to guess, except it likely contains much less entropy than your actual password.

Comment Meaningless. (Score 1) 538

Nothing has changed.

When applying a hash+salt to a password to store in a database, you run it a bunch of times to take up an attacker's cpu time. By picking the number of repeated hashes, processing a password->hash attempt can be made to take any amount of cpu power. When designing a system, one attempts to choose a value such that, with current systems, it takes a reasonable amount of time to process a login but also too long for an attacker to brute force.

TFA talks a lot about the 'number of possible combinations', but in reality that is not strictly relevant.

What matters here is only how much more cpu power is available to attackers than to the site owner. This ratio is what determines the number of 'combinations' required to defend against attack by someone who steals the database. So, if attackers start using hardware to run hash algorithms, sites can as well, and the same balance would be maintained.

Comment Re:Unionize this (Score 1) 1008

The issue with "undocumented" labor taking jobs is that minimum wage laws are selectively enforced, not that they are willing to accept a lower wage. In most cases, if a citizen attempts to get a job at an illegal rate they will be rejected, but enforcement for the most part looks the other way in the case of "undocumented" workers. If minimum wage laws were repealed, there would be plenty of citizens lining up to take these jobs at the lower rate.

Comment Re:Long term yes for windows 8 no (Score 1) 440

Bytecode interpreters, as opposed to scripting languages, have a very real advantage that is unrelated to speed: you can use any language. If the target is the .net CLR, you can use C#, VB.NET, C++, F#...plus about a hundred others. Going with the .NET platform allows the language to be flexible, whereas with javascript you're stuck with a hacked language with no internal consistency, ridiculously stupid semantics in some cases, and a loosely typed straitjacket that causes problems in any larger application. Of course if we're using .NET and you LIKE the javascript language, a compiler could easily be developed that compiles it to .NET IL. The opposite is not true.

Comment Re:This annoys me somehow (Score 2) 161

Worse, if you RTFA you will see discussion of the fact that moon rock samples were twice given to each of the 50 states and to each existing country at the time.

There is absolutely no reason to assume that with all those countries, all of them legally prohibited the transfer of state gifts to private individuals. I'm sure several of those could be privately held, completely legally.

Of course, it would still be super rare and the owner would likely retain the gift set itself, which would pretty easily differentiate the sample from those stolen from NASA.

Comment Re:In other news (Score 1) 267

Comcast is likely your only choice because the government has already interfered in the matter to make it the case. But even if it is truly so that only Comcast wishes to provide service to the area, it is still better than the government taxing you $100 a month and providing you crappy internet access whether you want it or not.

And, if the current single provider situation is not due to government interference, it is likely that sometime in the future you could get a better option. Government services tend to be slow to change and wasteful.

Slashdot Top Deals

The only possible interpretation of any research whatever in the `social sciences' is: some do, some don't. -- Ernest Rutherford

Working...