Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Comment Re:Microsoft could accelerate this rapidly (Score 1) 95

I think times have changed. Most everything people need now is a website. All Windows on Arm really needs is a good web browser and Office.

Microsoft is reportedly working on a translation layer. My understanding is that x86 32-bit apps work now, but 64-bit compatibility is in progress.

https://www.techrepublic.com/a...
https://docs.microsoft.com/en-...

Comment Re:Microsoft could accelerate this rapidly (Score 1) 95

It already exists. Windows on ARM is already a thing. M1 Macs can run it in virtualization.

https://9to5mac.com/2021/05/03...

But, that is mostly a parlor trick. The bigger question is if and when more powerful ARM processors will be available from other CPU manufacturers (AMD, Qualcomm, Samsung, heck even Intel), and when Dell and Lenovo start making laptops with them.

Comment Re:M1 (Score 1) 95

Not an also-ran, but I think this is the beginning of the end for x86.

Let's face it, CISC instruction sets are cumbersome and outdated, and everyone has known that for decades. Even Intel knew that when they tried to strong-arm everyone onto IA-64. The industry has been waiting for a viable RISC-like ISA to arise and challenge x86 for a long time. I've heard and read conjecture many times about ARM being that challenger. The question was always whether an ISA designed for low power could scale to desktop performance. Apple proved that it could.

Yes, there have been other RISC ISA desktop processors before, but none have had enough advantage over x86 to warrant the pain of transition. A lot of that had to do, I think, to the fact that Intel's manufacturing processes were consistently one to one and a half generation ahead of their competition. Intel's process advantage has degraded and reversed itself to the point that the ARM based M1 is embarrassing Intel's processors on single-threaded workloads. Intel Core processors are still better for some multi-threaded applications, but AMD is eating Intel's lunch there as well. AMD has ARM CPU designs in their back pockets that I'm certain are getting dusted off for manufacturing now. I don't expect it to take long for an AMD or Qualcomm to crank out 10, 20, 50, 100 core beasts that run on less power than an i9.

Intel is in such a bad spot they are now talking about RISC-V and about manufacturing chips for former rivals.

Comment Re:Where‘s the damage (Score 1) 68

[Blech] but I object to Let's Encrypt because it empowers malicious actors to get trusted SSL certs without putting up any kind of payment or personal identification.

Let‘s Encrypt verifies that the requestor of a certificate is in control of the system that the certificate is for. The kind of certificates Let‘s Encrypt provides say nothing more than “this connection can be considered private between you and the person controlling the system you are talking to“. If a malicious actor is in control of the system a malicious actor is in control of the system.

Agreed, but web browser vendors have historically presented the notion that SSL=Secure, and that's what most users believe.

Once a malicious actor has an SSL cert, it becomes easier for then to hide their traffic from firewalls and antivirus, and there are plenty of examples of Let's Encrypt's services being abused in this way.

- A payment paper trail is an accident and not reliable
- A connection is either securely encrypted or it is not. I don‘t see how Let‘s Encrypt makes it easier to hide traffic than any other SSL encryption

The paper trail may be accidental and unreliable, but is better than nothing. Crime syndicates get busted based on paper trails. Let's encrypt certs is just too free and too anonymous.

To inspect traffic I have to run a forward SSL proxy at the firewall, breaking the SSL trust environment. Antivirus software does the same locally to scan incoming HTTPS traffic. That causes a lot of browser problems. As a result, end users and organizations turn off or never implement these features. It's a huge blind spot.

Overall, I maintain that Let's Encrypt reduces security. Let's Encrypt, for their part, says it's not their problem

Easily available encryption per default makes the Internet a safer place by introducing security because by far most communication is valid. Every connection should be private to third parties because no third party can be trusted by all.
Everybody and their dog reading your clear text http connection may give you a warm feeling, but it it reduces security.
If your system‘s security against a virus depends on enforcing clear text communication with external parties you did not lose the game but you never entered the stadium.

SSL does a pretty good job of resisting passive observation (assuming it is configured well), but it doesn't do a lot to stop man-in-the middle attacks. The SSL can be security theater when DNS security is still a mess, 90% of home users have routers riddled with bugs and use default passwords, and most web servers' default HTTPS configurations are vulnerable to downgrade attacks or redirection to plain text HTTP. Heck, ARP poisoning has been a thing for 40 years with no real solution.

There are a ton of static sites and landing pages out that just don't need SSL encryption. Pushing for SSL everywhere doesn't add anything but a host of insecure, poorly configured, easy to hack HTTPS protected web servers to the Internet. Sure, the servers would still be easy to hack without SSL, but at least they encrypt their malware payloads before sending it to their victims.

Comment Re:Do you even use it? (Score 2) 68

I know this is an unpopular opinion around here, but I object to Let's Encrypt because it empowers malicious actors to get trusted SSL certs without putting up any kind of payment or personal identification.

Yeah, I know that a certs are cheap. Even without Let's Encrypt I buy certs for less than 10 bucks per year. But, that requires some kind of payment, and that means a financial paper trail. With Let's Encrypt, there is no financial transaction. Yes, criminals can use stolen credit cards to buy certs, but that keeps financial companies in the fight with their fraud protection departments.

Once a malicious actor has an SSL cert, it becomes easier for then to hide their traffic from firewalls and antivirus, and there are plenty of examples of Let's Encrypt's services being abused in this way. Overall, I maintain that Let's Encrypt reduces security. Let's Encrypt, for their part, says it's not their problem.

Comment Re:Here's an offensive term (Score 3, Informative) 570

It was accurate for IDE ribbon cables. Back in the day, we always set the more important device that needed better throughput as master. I've seen the terminology used on some SATA controllers, where the terms are obsolete.

https://computer.howstuffworks...
"To allow for two drives on the same cable, IDE uses a special configuration called master and slave. This configuration allows one drive's controller to tell the other drive when it can transfer data to or from the computer. What happens is the slave drive makes a request to the master drive, which checks to see if it is currently communicating with the computer. If the master drive is idle, it tells the slave drive to go ahead. If the master drive is communicating with the computer, it tells the slave drive to wait and then informs it when it can go ahead."

Comment Re:Here's an offensive term (Score 3, Insightful) 570

Words to matter.

I agree

Using Master and Slave vs say Primary and Secondary creates a different set of understanding on its functionality and its relationship with it.

Does the "Master" really control the "Slaves" functionality. Say back in the Old IDE Drive setup. the "Master" Drive is only what handles the boot loader, but it doesn't do anything to control the "Slave" Drive. Primary and Secondary is a better terminology for it.

On an IDE chain, the master does have control over the slave drive. The slave drive can not communicate with the host controller without clearance from the master. https://computer.howstuffworks.... Are "master and slave" the best words for this arrangement? Probably not. It is more accurately descriptive than "primary and secondary". But, it's also obsolete terminology that doesn't have relevance to modern SATA.

Also the traditional image of the Master and Slave, have a negative context, and the fact that such words offend plus also force to bring up images of an unrelated issue is a problem.

You can just realize that if you simply just change some wording, you can reduce the suffering that people may have from it.

I doubt that. People like being offended.

But that seems too much for some people because they are afraid if they just try to be nice to others that somehow they are going to loose everything

A bit of a straw-man argument. In this case, I think most of us in technology just don't see the point and can't be bothered when we have work to get done.

Also the argument, "Why worry about this little thing, when they are bigger things" is just a way to try to deflect the problem vs actually solving it. We as a population of people have the resources to work on several tasks at the same time. It isn't like we as a Coder or documenter into fixing and updating some wording. Often it just take a minor change to a behavior and perhaps a global replace. When creating documents or conversing especially professionally , I try to make sure that I don't end up sounding like an asshole so I pick my words carefully, as I don't know who may be reading it, and how my words could effect them.
I normally try to make sure my words are racially sensitive, as well don't trigger PTSD (Such as words like Kill, Bleed, Shoot...) If I can do some simple changes and I prevent a person from feeling bad then all the better.

Going forward, I agree that some the terminology should be changed. Master and slave being one. I have a co-admin that made an Active Directory OU named "Dead Acounts". I changed that to "Former Employees".

Changing some other terms will only create confusion and pointless work. Whitelist and blacklist have nothing to do with race. It's good and bad. Angels and devils. Cowboys with white hats and cowboys with black hats. Some people make everything about race because they have to have something to crusade over. No matter what you write or say, someone will find a way to be offended when they dig it up in 20 or 30 years.

What I don't want to see is revisionist whitewashing of documents to cover up our industry's dark history of insensitive jargon. Lets fix what we have to, put an asterisk on it, and move on. But while we do so, lets not be hyperbolic about what we are doing. We won't be fixing the world's ills. It's just about not painting a target on our own backs.

Comment Maybe we should all read the opinion (Score 1) 108

before calling for an armed revolt. This is not the end of the world. This does not announce open season for telemarketers. The decision does not affect unsolicited text messages, regardless of how they are sent, which are still prohibited by by the TCPA.

https://www.supremecourt.gov/o...

Sotomayor's opinion is only barely over 2 pages. I'm sure everyone here can handle reading that. In it she essentially says that congress was overly specific in their definition of "autodialer". The rest is additional court opinions and details of the case. Don't all of you complain when the Supreme Court legislates from the bench? Here's a case where they interpret the law strictly and you still complain?

Incidentally, the plaintiff never alleged that the texts were unsolicited. It seems that he had a phone number that belonged previously to a Facebook user who had opted the phone number into security alerts.

In my opinion, it was the United States Court of Appeals for the Ninth Circuit that really screwed this up. The trial court ruled against the plaintiff saying that the security check is not an auto dialer. Because IT'S NOT. A server that calls a single text message as a security notification IS NOT AN AUTODIALER. The 9th circuit reversed that ruling, which makes zero sense in context of what the TCPA was meant to curtail, which was massive phone and text message spam. If the 9th circuit court had made the RIGHT decision, this would probably have never been heard by the Supreme Court.

Once again, a security alert generated in response to a login and sent to a stale telephone number IS NOT SPAM. The fact that the plaintiff received (and I quote ) "several login-notification text messages from Facebook", and that he turned that in to a goddamed class action suit is utterly ridiculous and a waste of our legal system's time. There is good reason that the The U. S. District Court for the Northern District of California dismissed the case with prejudice.

Comment Douglas Adams had it right (Score 1) 256

I'd like to join The Campaign for Real Time, now.

"The Campaign for Real Timers claim that just as easy [time change] eroded the differences between one [hour] and another, and between one [timezone] and another, so time [change] is now eroding the differences between one [season] and another."

Comment Re:Schools buy them in bulk (Score 2) 133

I'd imagine that a lot of parents bought them for their kids. I bought one for my 10-year-old. She didn't need one before, but now that my wife is effectively homeschooling her, the resource was needed. It integrates with her school's Gsuite accounts. It's affordable, simple, and effective for her needs. The fact that it isn't a general purpose computer means there is less to go wrong. As an elementary through middle school homework machine it's a no-brainer.

Slashdot Top Deals

Always draw your curves, then plot your reading.

Working...