Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Comment Re:Constitution (Score 1) 568

You don't need to sue them, you can simply not do business with them and they will have no data to collect. No one forced you to do business with these corporations. The ability for them to sell your data is made clear in the user agreements. Whether or not you read them, it's pretty much common knowledge.

Comment Re:just now? (Score 1) 398

" 7 dog years = 1 human year. How many years would it be for a digital dog @ 4.4GHZ?"

The same amount of time as it would be for a digital human. Changing the units of measurement does not turn years into seconds, it's still the same length of time. You are so blatantly stupid, yet think you are qualified to tell people they are wrong regarding things you obviously possess only a pseudoscience knowledge of... is the only thing that is mind blowing.

Comment Re:jailbreak != breaking encryption (Score 2) 398

Exactly, jailbreaking a phone is a completely different animal, because within the device somewhere is the private key, and it is only hidden through obfuscation. Just like a desktop, you have access to the complete system, and it's just a matter of time, skill, and effort to pulling it a part and either finding the private key or bypassing.

On the other hand, a proper keyless system has the private key in the FOB, and assuming all the components of the system are properly implemented using well established security standards, then there should be no FEASIBLE way to defeat the cryptography in a short amount of time without physically stealing/breaking open a FOB or physically modifying the vehicle.

In the phone case, the manufacturer wants to prevent you from breaking into the phone, but they handed you the private key inside the phone. In the case of the vehicle, only you the owner carry the private key in your FOB, and the criminals do not have that. Unfortunately there's probably alot of vehicles with vulnerabilities or not even an architecture that could laughably be called security.

Comment Re:just now? (Score 3, Informative) 398

I would be surprised if the majority of keyless entry was RFID. It may be that the vulnerable ones use this, but RFID is not in anyway a form of authorization. It is a form of identification. The difference is your username and your password. Anyone should be able to get the RFID and be no closer to accessing the system, just as your username is not private information and is fairly useless without the password. Their are lots of easy and inconspicuous ways to steal an RFID because it's just their saying "HEY, I'm 157951234654..." and anything can read that ID and then easily masquerade as that RFID.

A proper keyless system uses cryptography(and does so properly). This is why many FOBS are quite expensive to replace and have a battery inside. When you attempt to unlock the vehicle, the vehicle sends a challenge to the FOB, and the FOB uses a private key to sign it, the vehicle then gets that signed response and verifies it using the public key. I know that my FOB uses a 40bit key, which isn't very strong. Hopefully the vehicle has delays in place to prevent someone from trying thousands of keys a second, otherwise it could be broken with brute force given the small key size. This would still take a good while though.

It's possible that some of these vehicles are vulnerable if someone got their hands on a database of public keys(or worse private keys), from which you could spend time searching for the private keys through brute force and build up a database of the private keys, and then load that list onto a portable device the masquerades as a FOB.

There's lots of possibilities.

Comment Re:Are you right out of college? (Score 1) 509

As someone who has been programming for 10+ years...

"Version control (revision control? WTF is that?)" You don't know what version control is? Or are you trying to start a worthless pedantic debate on terminology?

"How do you make a mess of version control other than just not checking stuff in?" That depends on the source control system, but they all have certain conventions/workflows you have to follow else you screw things up.

"Code reviews are pretty fucking stupid, IMO." There's not much of any other way to ensure code quality. If they wrote their own tests, the test could not feel out corner cases, security, reasonable efficiency, etc. Things QA would probably not catch. That action method on a controller that doesn't have a permission check and exposes sensitive data. You can point fingers and say QA's job to test for that, but even if you were right, you still wrote it wrong in the first place and someone has to touch it again. Code reviews give people an incentive to do it right the first time, and if it's not right, at least they will be fixing it while it's fresh on their mind and they can learn from their mistakes. Lots of shit coders write shit code and it works 9 times out of 10. Overtime you rack up a long list of bugs and instead of coddling it along with band aids and duct tape, you finally tear it all out and redo it. So in the end it's not worth paying people to write shit code. It's very much like the contractor who has to tear out a shit job and make someone redo it right. No point in paying someone to write code that someone else will have to tear out and rewrite later.

On the other hand, I like having my code reviewed. Rarely there is a slip up, maybe I didn't handle a transaction perfectly or think about a certain corner case. Sure it tested fine, but there would have been a race condition at some point down the line that would have slowly accumulated bad data each time it happened. Much better that someone else catch it now before it goes to production and causes some difficult to track down bug that is difficult to reproduce and causes people to have to spend a time fixing bad data.

Comment Re:or sqlite (Score 2) 241

"99% of the small web sites which are built around MySQL don't need it."

Likely they are running on a virtual share, and as such as using the cheapest thing available that also supports the web apps they want to use.

If the web app happened to support SQLite, it would still be a better choice to use the hosting provider's MySQL server since it is already configured for backups and likely runs on a separate piece of hardware from the virtual web server. Additionally they are probably using multiple tools, CMS+blog+wiki+forum or some such, and better to just offload all that to the database server.

Even if all these apps supported sqlite, the hosting provider still has to hire a programmer to write code that somehow iterates through all the virtual hosts, finds all the apps running SQLite, and perform backups through the backup API. With MySQL, having all the databases in a central location and a nice community of tools that already handles this sort of thing with a bit of configuration is cheaper.

On the other hand it would be easier on the setup side of the web apps to use SQLite, because no longer will you need to deal with creating the database+permissions+connection strings. Probably the easiest solution is some sort of easily discoverable network service that provides a central backup service, that the host would have for all the SQLite applications to discover and perform backups to.

Just my opinion, but I wouldn't suggest SQLite as the DB of choice for small websites.

Comment Re:They're doing it wrong! (Score 1) 262

We are here looking at a collection of interesting images, that are not inflammatory in the least, and you bring some political bullshit into the mix. What more is there to get?

I pointed out how baseless and nonsensical your ramblings are. I think it is clear that you are trying to hard. All the attributes of a good conspiracy theory. Even the fact you are here completely out of context and offtopic, like the crazy guy screaming on the corner. You even brag about your ignorance of how off topic you are. It's one thing to comment based on the summary without reading the article, it's a whole other thing to comment on presumed content that is neither in the summary nor the content of the article, simply because you want an excuse to cry to everyone about your bullshit. If how you came to the conclusion that your ramblings were appropriate here, then it's a good indication of how you formed your opinions.

I don't blow off everything as conspiracy theory. I don't mind someone with a different opinion, if it is formed on some level of rational thought, rather than on assumptions and ignorance.

Slashdot Top Deals

"The only way I can lose this election is if I'm caught in bed with a dead girl or a live boy." -- Louisiana governor Edwin Edwards

Working...