Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
×

Comment Why he's got it wrong at step 1 (Score 2) 608

ESR is making an early invalid assumption - that "fast transparent garbage collection will happen".

Sorry, no. The smartest people in the CS world - possibly the
smartest in the world, period (specifically those at MIT AI Lab,
Xerox PARC, BBN, TJ Watson, and Stanford) worked the GC problem
for literally 20 years, throwing hardware at it, software, tagged
architectures, secondary processors, all that.

They never cracked it. GCing at realtime speed is just a tough problem.
Unless ESR can show me code that can GC in faster than O(n) time
AND not have to freeze the allocator process for O(n) time, he's just
pitiably wrong.

(and no, I don't count flip and sweep GC as workable in this, as it
means that a buffer that DMA hardware is writing to will move without
warning. Nor is "generational" GCing, all that does is to stave off the
inevitable full-out GC for a few minutes to hours, which is fine for a
hacker sitting at a terminal but no good at all for a self-driving car or
SaaS server).

Now, I could be wrong; if he *has* a realtime garbage collection algorithm
then he deserves the Turing award.

But I'm betting "not".

Comment Re:Android updates suck (Score 1) 136

Maybe. I believe the media exploit from a year or two ago on Android was patched on phones assumed abandoned by OEMs.

Sadly, for many customers they rely on the goodwill of their OEM and telco to provide serious patches. I expect shops like Samsung, Lenovo/Moto, LG, Sony, and HTC to patch pretty much any phone sold in the past 3 years or so.

Budget buyers, no-name brands, etc are most likely going to be hacked constantly until they replace the phone. KRACK is bad but WPA-AES means they can't inject data and that's on top of TLS blocking that as well. Blueborn, on the other hand, is much more serious and could provide root remotely.

Submission + - Some Motherboards Plagued by BIOS Firmware Implementation Flaws (bleepingcomputer.com)

An anonymous reader writes: Alex Matrosov, a security researcher for Cylance, has discovered several flaws in how some motherboard vendors implemented Intel UEFI BIOS firmware into their products. These flaws allow an attacker to bypass BIOS firmware protections, such as Intel Boot Guard and Intel BIOS Guard, to disable and alter UEFI BIOS firmware, such as placing a rootkit.

In total, Matrosov found six vulnerabilities in four motherboards he tested: ASUS Vivo Mini (CVE-2017-11315), Lenovo ThinkCentre systems (CVE-2017-3753), MSI Cubi2 CVE-2017-11312 and CVE-2017-11316), and Gigabyte BRIX series (CVE-2017-11313 and CVE-2017-11314). The motherboards Matrosov tested were based on AMI Aptio UEFI BIOS, a popular UEFI BIOS firmware package, also used by other motherboard OEMs such as MSI, Asus, Acer, Dell, HP, and ASRock.

"Some vendors don’t enable the protections offered by modern hardware, such as the simple protection bits for SMM and SPI flash memory (BLE, BWE, PRx), which Intel introduced years ago," Matrosov explained the problem. "This makes them easy targets for attackers since they have no active memory protections at the hardware level."

Comment Gmail ignores dots (Score 0) 565

I bet your problem is that someone else has the same email but with a dot in it somewhere. I ran into this problem a few years back-- I had also registered lastname@gmail.com, and I started getting emails for l.astname@gmail.com and a couple other variations.

There was an Asian couple in Virginia, I got their emailed Apple Store receipts. And there was someone in South Africa who was renting out an apartment, so I got all kinds of information from prospective renters like photocopies of passports and pay stubs.

I ultimately had to abandon that address and get a different one.

Comment Asinine (Score 1) 285

This is asinine. And it's made worse by the fact that when you do use the app-switcher to switch to an open-in-the-background app, it's actually showing you a screenshot of the app as it was sometime prior to it getting frozen. When I reactivate the calculator app (not from a force-click, but open in the background), it shows a screenshot of calculator and I start tapping the numbers, but then the app actually becomes active and many of my taps were missed. I'd like it better if it showed a loading screen or something that would indicate that the app isn't ready yet. These things really aren't as quick as they say they are.

Comment Love kindle, but... (Score 4, Interesting) 206

I love my kindle but ever since the various publishers and amazon settled and they started setting their own prices, the ebook prices are way too expensive. In a lot of cases they are more expensive than the print copies and they have way more restrictions. I can't lend or give them to my brother (some pubs allow lending but only N times and only for 2 weeks at a time, which is absolutely ridiculous). I can't donate the book to a library if I don't plan to read it again. I would be ok with these restrictions if the ebooks were cheaper.

The other thing that sucks on amazon/kindle is trying to find decent books. I have to go visit B&N to find new sci-fi/fantasy novels because the search/discovery on amazon is terrible. For every 1 fantasy novel by a major publisher and a well-regarded author, there are about 500 indie "books" that are just terrible. (Yes, there are some gems in there, but it's really difficult to find them.) It seems like amazon is just concerned with the volume of books on their store, not the quality of them. If I could filter out the "kindle unlimited" books from all of the lists it would make things a lot better.

Comment Good feedback! (Score 1) 88

Bricking insecure devices has a nice upshot - the cost of a returned device isn't just the profit - because all of the handling and
coping has to be done (so far) by a human, the actual _cost_ to the distributor or manufacturer of a failed device is often the
loss of profit on the whole minimum order quantity to the distributor - the whole crate.

That's why if you get a DOA item from Amazon, they often don't even want it back, they send you another on your word of
honor- not because they're so nice, but because (absent evidence of fraud) IT'S CHEAPER TO JUST SEND ANOTHER
RATHER THAN RECEIVING THE ORIGINAL DOA UNIT BACK AND DISPOSING OF IT UNTESTED. It's not free, just cheaper.

But just because it's cheaper, doesn't make it nonzero. Every bricked device replaced under warranty costs $$ and every
device that fails, in warranty or out, costs reputation. How much would you pay for an iPhone if the battery stopped
holding charge after between three days and six months of use?

Bottom line: it's damn expensive to adequately secure an already-damn-expensive IoT light bulb. And as BrickerBot
expands (and no doubt improves, just as the original chemotherapy drugs were improved) the cost to make a secure
IoT device is going to skyrocket.

Which may effectively doom IoT for consumers. Industrial IoT is a different game with different rules and the most
important is that airgapping is feasible.

Comment Two reasons- Training and Reliability (Score 1) 388

There are two reasons to NOT change the software - or at least the view seen by the users:

1) Training - learning an application represents a significant investment in time and mental energy. Making a significant change in the interface (or worse, the actual workflow) means relearning the app, sometimes from worse-than-scratch because you already know what's wrong! So, if you have to relearn, you can relearn another app that doesn't have the feature and workflow churn.

2) Reliability - adding code adds bugs. Code that once worked fine now doesn't. This again forces users to consider if it's time to learn another application and workflow simply to get away from the bugs.

Comment Re:I don't even know my passwords (Score 2) 652

Using 2FA authentication won't work to stop them.

They ALREADY ask you to allow inspection of electronics. If you refuse to give them the password, expect to not get your phone, laptop, or tablet back till you either give them the password or they image the whole thing for NSA's "enhanced decryption".

Comment Okay, what's the business model then? (Score 4, Insightful) 234

Which leaves us with the interesting question of LastPass's business model.

1) Advertising? Knowing every site you visit - AND YOUR PASSWORD?

2) "We have a benefactor". Yeah. Except that maybe that benefactor is the NSA. Or is it the GRU? Or is it the MSS (China's NSA)?

No matter how I slice it, I can't figure out an angle that isn't kinda creepy.

Slashdot Top Deals

Top Ten Things Overheard At The ANSI C Draft Committee Meetings: (5) All right, who's the wiseguy who stuck this trigraph stuff in here?

Working...