Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
×

Comment Re:So (Score 0) 194

"There are those who say you need to use RequestPolicy and Ghostery and AdBlock and NoScript (and some other stuff, like a cookie blocker) to catch everything...."

It's a sign of utter insanity among the browser maintainers.

All this crap should be guaranteed off by default, and require an extension to enable, rather than the reverse.

Comment Re:New SSL root certificate authority (Score 1) 129

Thanks for the insult. It hardly stung.

Unless you worked at Netscape in the mid-1990s, no insult was intended.

All I meant is that by the very early 1990s, we (and by "we" I mean people smarter than me; I was clueless at the time) had a pretty good idea that CAs wouldn't work well outside of real power hierarchies (e.g. corporate intranets). But then a few years later the web browser people came along and adopted X.509's crap, blowing off the more recent PKI improvements, in spite of the fact that it looked like it wouldn't work well for situations like the WWW.

Unsurprisingly, it didn't work well. Organizing certificate trust differently than how real people handle trust, 1) allows bad CAs to do real damage, and 2) undermines peoples' confidence in the system.

A very nice way of saying this, is that in hindsight, the predicted problems are turning out to be more important than we thought most people would care about. ;-) It's almost as though now (no fair! you changed the requirements!!) people want SSL to be secure.

Keeping the same organization but with new faceless unaccountable trust-em-completely-or-not-at-all root CAs won't fix the problem. Having "root CAs" is the problem, and PRZ solved it, over 20 years ago.

I expect you to start the project shortly.

It's a little late to start, but I do happen to still be running an awful lot of applications (web browser being the most important one) which aren't using it yet.

Comment Re:Secure pairing is hard (Score 1) 131

How does Diffie-Hellman key exchange provide identification of the other party? .. It is not possible to determine who the other party is

It's possible. It requires an extra piece beyond the DH, but that extra piece isn't PKI. The user is the trusted introducer. The user looks around and says "Yep, these are the only two devices physically here that I have ordered to peer, right now." They are identified by being in the right place at the right time, triggered by the user saying "Now." That's a pretty good way to do things unless you're just totally surrounded by spies.

Comment Re:The point? (Score 0) 454

"So how much is your family worth?"

An emotionally resonant argument but not a rational one.

Cancer, heart disease, kidney disease, and diabetes are the leading causes of death in Israel. Rockets fired by Hamas is waaaay down the list, and it would still be waaaay down the list without the interceptors.

Let's say you can spend a billion dollars to save one person from death by rocket, or the same billion to save 250,000 from cancer, but of course you cant do both, once the money is spent it is spent. Which is the wiser use of the money?

Comment Re:Yet another reason to turn off Ecmascript (Score 2) 194

Not really. The Amish reject technology across the board, whether useful or not. People that are on the internet are obviously not rejecting technology across the board - javascript-in-the-browser is a single, very problematic technology, which is responsible for the vast majority of computer infections.

So no, people that do not allow javascript are not much like the Amish of the internet. We are more like the 'people who know how to use condoms' of the internet.

Comment Re:The point? (Score 0) 454

So it's designed to stop the threat that does not exist, and therefore should be excused for failures against the one that does? That makes little sense.

"And eve if it really was only 5% effective, I'd take 5% less ballistic missiles headed at my town thank you."

Irrational. When the damage done by the ineffective rockets is less than the cost to shoot them down, the money could clearly be better spent elsewhere.

That would be true even if the conflict were not one of choice, but is doubly so in the current situation.

Comment Re:As it should be (Score 1) 234

"Sacrificing upload to gain extra download makes perfect sense when the person at the end of the line does far more downloading than uploading"

Two false postulates concealed here.

First that upload and download can be totally separated. Common misunderstanding. The way the internet works, all traffic is bidirectional - even if you are coming as close as possible to 'pure downloading' you are still using your upstream for traffic management. So while a certain amount of asymetricality can be tolerated, as long as the usage cases are very narrowly limited, even with all those caveats it can still amount to fraud. At least, if you are paying for 100mbit download but given so little upload allowance that you could not use it, you would probably call it fraud (when and if you caught on.)

But that is relatively minor in comparison to the second, which is that the internet is designed and should be used as a peer to peer network. It is not a broadcast network, and it was not designed to replace TV or facilitate more intrusive advertising. Asymmetrical bandwidth caps are thus seen correctly as direct attacks on the Internet itself - attempts to limit customers, to prevent them from truly and fully joining the Internet, since the cable companies prefer to keep making their monopoly rents instead of having to compete for our dollars.

Comment Re:As it should be (Score 1) 234

"When you're talking DSL or Cable, it's a different ballgame, due to the frequencies in use."

Uh, no it's not.

The frequencies in use? What kind of BS is that?

The frequencies in use do not care which direction the traffic is going in. I suppose I just hallucinated having SDSL for years?

Comment Re:Technology is only a small part of the problem (Score 1) 129

It's a small part, but it's a part. I think Snowden has done his fair share of trying to inform laymen and stir up giving-a-fuck. If he wants to switch to working on tech, he could accomplish nothing and still come out far ahead of the rest of us. ;-)

The existence of a decent open-source router can't do much against a U.S. National Security Letter.

While we certain should care enough to force our government to stop being our adversary, there will always nevertheless be adversaries. You have to work on the tech, too. Even if you totally fixed the US government, Americans would still have to worry about other governments (and non-government parties, such as common criminals, nosey snoops, etc), where you have no vote at all. You will never, ever have a total social/civic solution which relies on, say, 4th Amendment enforcement to keep your privacy. I'm not saying your chances are slim; I'm saying they're literally 0%.

Furthermore, getting our tech more acceptable to layment acually would correct some of the problems inherent with NSLs, improving the situation even in a we-still-don't-give-a-fuck society. If you do things right, then the person they send the NSL to, is the surveillance target. The reason NSLs (coercion with silence) works is that people unnecessarily put too much trust into the wrong places.

For example, Bob sends plaintext love letters to Alice, so anyone who delivers or stores the love letters, can be coerced into giving up the contents. OTOH if they did email right, then if someone wanted to read the email Bob sent to Alice, they'd have to visit Bob or Alice. That squashes the most egregious part of NSLs, where the victim doesn't even get to know they're under attack.

That's true whether we're talking about email, or even if Bob and Alice get secure routers and VPN to each other. One of them gets the NSL ordering them to install malware on their router.

Comment Re:New SSL root certificate authority (Score 2) 129

A nice step ahead would be the establishment of a new set of root certificates...

The lesson of CA failure is that there shouldn't be root authorities. Users (or the people who set things up for them, in the case of novices) should be deciding whom they trust and how much, and certificates should be signed by many different parties, in the hopes that some of them are trusted by the person who uses it.

If you want to catch up to ~1990 tech, then you need to remove the "A" in "CA."

Slashdot Top Deals

Crazee Edeee, his prices are INSANE!!!

Working...