Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×

Comment Re:Why can't this be the law everywhere? (Score 1) 271

The Unions were a necessary phase in worker's rights, but now they are holding us back and they need to go away and be replaced by rights for all workers. If the Union leaders spent half as much effort to raise the minimum wage on a meaningful schedule as they do on padding their own pockets I might feel differently.

If unions are obsolete, what does it matter what they spend their time on? They aren't preventing you from lobbying for those rights, are they?

Comment Re:Huh (Score 2) 271

A history of sexual predation should never be erased from the public memory. I don't give a rip if this particular guy is "living a new life" -- if your brain is broke in such a way as to be attracted to kids then you should no more be allowed to walk the streets than a lion who thinks kids are tasty.

The difference between lions and humans is that lions can't reconsider their life, while humans can. So it comes down to the risk: what are risking if we trust this person to be changed? What are we risking if we don't?

But perhaps the risk is too high in the case of child molesters, or we simply decide they deserve to suffer. In that case, that needs to be spelled out explicity in the form of a life sentence. Pretending the sentence is, say, 5 years while letting the "unofficial" system inflict a de facto life sentence is dishonest and against the rule of law. Society should have the balls to admit its own true character to itself and then change if it can't live with it.

Comment Re:Competent Authorities (Score 1) 146

He's shown wikileaks is about his ego, not truth.

Right. So did he lie?

Yes. Repeatedly and publicly (ex: his acceptance of bail conditions before fleeing justice), yet somehow for the true believers like you, every instance can be argued away.

Read the original quote. Notice how it talks about Wikileaks not being about truth. The issue is not whether Assange has ever told a lie in his life (because everyone has, and frankly it doesn't matter except for a smear campaign), it's whether the leaks he published on Wikileaks are lies.

Sure, not sharing your messianic opinion of Assange and wanting him to be judged like a normal person is capitulating...

Right. So do you think a normal person would be judged like this for not wearing a condom? Because that is what the Swedish lawsuit is nominally about.

But ultimately, what does it matter? Even if you proved mathematically that Assange is the Devil himself, that still wouldn't change the fact that Wikileaks merely unmasks the sins of the powerful. If you have nothing to hide, you have nothing to fear, right?

Comment Re:Competent Authorities (Score 1) 146

First off, thats a request even if you continue your typical bullshit lying Assange.

Speaking of bullshit and lying...

The only reason he's not in jail in Sweden already is because Ecuador feels like trying to be a dick to the US.

So you agree that it's the US, not Swedish law, that wants him imprisoned and made an example of? Because your assertion doesn't really make sense otherwise.

Whether or not Assange is personally admirable or even likable, it's the US and its allies who're the villains in this story. Wake up and see the skulls on your caps, or they'll be the only thing you'll be remembered by, since they'll take over everything you do, and then get you killed.

He's shown wikileaks is about his ego, not truth.

Right. So did he lie?

He's shown he thinks he's above the law and that he thinks EVERYONE else is corrupt and out to get him.

And you're proving him right.

He's a douche, so much a douche that even France thinks he's a douche. How sad do you have to be when even France doesn't capitulate?

But France is capitulating, again, to the skull-caps.

Comment Small HTPC out of WD external HDD enclosure (Score 1) 210

Today, there is no shortage of SBCs out there, and intel has released some pretty powerful x86 based ones, like the minnowboard max 2.

On the market at this very moment, Western Digital is offering an external hard drive that has an interesting enclosure. (See Western Digital MyBook 3TB and 4TB models) This is basically just a little triangle shaped USB to SATA adapter attached to a standard 3.5 inch SATA HDD, which is itself mounted on 4 little rubberized pegs, held into the enclosure via some little receptacles for the rubberized pegs.

Now, the hardware hack.

I bought one of these late one night (way after midnight after all more reputable sources of computer parts had closed) just to get the HDD inside, as I needed a replacement RIGHT NOW. (Got the 4TB version. 3Tb drives have terrible failure rates. It was a 4TB WD Green series SATA drive. Not splendid, but it serviced.)

That left me with the shell. For awhile I left it to sit around and ignored it, but the more I looked at it, the more it just screamed to have something done with it.

The drive kit came with a 12vdc wall wart that can put out about 30W of juice. The enclosure has cutouts for the 12v barrel connector, the "USB3.0 HDD style" connector, and a lockstrap hole.

Minor modifications with a dremel tool made the USB slot into a standard USB sized opening, and the lockstrap hole large enough to accomodate a mini HDMI port.

Inside, I took a 2.5in to 3.5in bay adapter, put the rubberized pegs on, then marked mounting points for a minnowboard max 2 with a sharpie marker, drilled them out, then attached standoffs using a combination of small back-facing nuts and washers. In the 2.5in bay, I installed a 2.5 inch SATA HDD.

The minnowboard is unique among SBCs, because it has a real SATA interface on it. It is a dual core intel atom system with intel integrated video. Whoopy freaking do, except for the fact that it's total TDP is around 6 watts. That's low enough to run without a fan, and well within the 30W the DC supply that came with the drive can deliver. The problem is that it needs 5vdc, not 12vdc. Easily fixed with a DC-DC power converter.

Long story short, I found that there was enough room inside the enclosure for the HDD, the minnowboard, extender cables going to the port openings from the minnoboard, an interal USB2.0 hub for things like WiFi and Bluetooth, the DC-DC power converter, and all that jazz.

It makes a very snazzy looking HTPC box.

Comment Re:Appears to be Fake (Score 1) 37

Yup, reading through that forum, it sounds as if the person who posted it up has admitted that it's a custom fake design. Plus, there's the fact that we know roughly what the actual device originally looked like, and it was quite a bit different. The original device was an add-on to the SNES, not a single-product hybrid console like this fake.

Comment Re:App-A-Holics anonymous (Score 1) 110

As a human being, I'm the highest power known to fucking exist. As we all are.

Except for market forces. Those certainly seem to be beyond the control of mere mortals. For that matter, laws of nature not only determine your environment, but through evolution your entire being: you want things you've evolved to want. Your main advantage as a human is that the process is much quicker with cultural rather than biological evolution, and your culture-derived traits can be updated during your lifetime.

And one of the things people have been evolved to want is to get high. That's not limited to humanity, but can be found in animals so low as bees. Such a widespread tendency strongly suggests this is not mere accident, but reflects some inherent aspect of the universe - a "higher power" - but even if it's not, it's definitely a pattern of human existence. Some people once called this particular power Dionysos. Whether it has an ego - whether it's what we'd call a "person" - is irrelevant to someone caught in its grip. Whether breaking such a grip throuh sheer willpower is possible depends mainly on how strong it is, but often requires help from another higher power, which can range from perception of divine power to fear of death to the team spirit of a support group. Heck, getting chewed out by your boss - an agent of the employer, itself in turn an agent of the Invisible Hand - for turning up hungover might be enough in some cases.

Comment Amnesty International has dealings with terrorists (Score 1) 109

Which isn't to say that they shouldn't necessarily have dealings with terrorists, but they don't always do a great job at keeping them at arm's length (like the ACLU generally manages to do when they defend people like the Ku Klux Klan), particularly in their dealings with Moazzam Begg.

But even if they were doing a better job of maintaining their moral clarity (a moral clarity built on fighting against arbitrary indefinite detention and torture, which is of course extremely important) in their dealings with extremists, they still might be legitimate surveillance targets simply because they are dealing with a significant number of people who, by any sane definition, we can reasonably suspect to be engaged in terrorism.

I'm one of the strongest opponents out there of mass surveillance, but it seems reasonably likely that this is targeted, and correctly targeted at that. This isn't a defense of unlawful imprisonment or torture. Amnesty should be able to meet with suspected extremists as frequently as they want, and intelligence services should (provided they are obeying the letter and spirit of their charter) be able to keep an eye on anyone who voluntarily goes to meet with (reasonably) suspected extremists... and particularly after Amnesty goes on to forge some ties with a rather nasty jihadi group. If we give them too hard of a time with targeted surveillance... well, we already know what the alternative is.

Comment Re:Why talk? (Score 1) 184

But, really, there has to be a degree of cognitive dissonance between the hope you'll do well and be super rich ... and the actual reality that, it's a tough slog, you might not get there, and you might have to trade away some equity to someone else to get there ... in which case your payout might not be as big as you hoped.

The difference between con-man and entrepreneur can be a thin line.

I've known a few people who fancied themselves the latter, but had worked themselves into such a feverish pitch trying to get there ended up as the former.

Sometimes people convince themselves things really are going to work out OK, even when completely unfounded. The human brain doesn't always like lying to itself.

Comment Re:Responses (Score 1) 251

You don't encrypt the UUID. It's just a verification to make sure they know the UUID, which is universally unique, generated by you, and sent only to your database and to their email address. All this does is establish that they have access to the email address they supplied. If you do as I suggest and tie this UUID directly to the user entry, an attacker can't do anything with this UUID without ALSO knowing the user's login and password. Clicking the unique link or knowing the UUID is useless unless you can also login as the user to access their row in the user table.

For password resets, you generate a random password and salt, set it to immediately expire, and then tell the user that password. You leave the old hash and salt in place - the new stuff goes in separate columns until the switch is done by the user. This prevents users from being unable to authenticate if an attacker merely requests a reset, or if you trigger an expiration due to whatever policies you have in place.

Your login page should authenticate the user (using the original password OR the new temporary one). If the user used their old password and authenticated successfully, you can ignore the reset. If they used the temporary password, block all authorization until a new password is supplied by the user (only let them get to the password reset page).

On the password reset page, ask for a new password. Double check hash(newpass+oldsalt) against the stored temporary hash (do the same for the old regular hash too, if you want). If it's a match, the user is dumb and entered the temp (or old) password. If it's not, you generate a new salt and store hash(newpass+newsalt), store newsalt, reset the password expiration date, blow out the temp password, etc.

The trick here is telling the user the temporary password. This is often done with a unique link (using another UUID) that automatically skips the authentication portion and goes straight to the password reset portion for that user. This is extremely fucking dangerous because anyone with access to the email address can hijack the user's account. Despite this, this is how most site on the internet do it. Sending the temporary password in plaintext or not makes no difference because sending the link in plaintext is functionally equivalent. Your security at this point is hoping the legitimate user made the request, is the only one with access to the email address, and the narrow time window in which the temporary password / reset link is valid.

Security questions, pin numbers, RSA clocks, text messages, heuristics (matching IPs, browsers, etc.) all provide more security, but are useful against a MITM attack or cover the scenario where a user forgot the security answer, doesn't know their pin, lost the RSA clock (dongle or phone), changed phone numbers, moved, etc.

Comment Re:Responses (Score 5, Informative) 251

My site, on account creation, generates a password and sends it to you in email in cleartext before putting it in the DB. In that email is a link to reset the password; you can't log into the rest of the site until you've done so. The updated password (and the original) are stored encrypted in the DB.

If anyone has a better suggestion, I'm all ears.

Don't send the fucking password in plaintext.
Don't store the fucking password. If your database/application can read it, then it's decrypted at some fucking point. Don't fucking do it.

User creates account.
User provides password, username, email, etc.
You generate salt.
You generate a UUID (emailverificationUUID).
You create DB entry with username, email, HASH(password + salt), salt, emailverificationUUID, emailverified (0).
You email the user "Your account has been created, please click this link to verify your email address.".
Link contains the UUID. When clicked, the site performs normal login processes (prompt login if not logged in already) and then verifies that the UUID matches the UUID stored for the logged-in user, and sets emailverified to 1 for that user if so.

Comment Re:Depression subtypes (Score 1) 184

Also, let me just highlight a few things here:

Rich people have have problems too, just like the rest of us: family feuds

If I was rich I could move the hell away from the family drama. Both my wife and I would love to do this. Problem (mostly) solved. I don't deny there could be some lingering stress, but when you're a few hundred miles away it would not be debilitating.

marriage problems

The number one issue of contention in most marriages is money. The number two issue is infidelity, which is entirely up to the personality and attitudes of the people involved--we're in an (nominally, at least) open marriage so that won't be an issue.

bills

If you're rich and worried about bills then you either suck at managing your money, you like living extravagantly/dangerously (not us. We were all set to buy a lovely little $50,000 fixer upper house on half an acre before I lost my last job), or you aren't really rich at all.

poor health

Granted, not everything is curable even with a ton of money. But a ton of money cures (or at least treats) a hell of a lot more than no money.

but depression could just as likely make it hard to find or maintain a job.

If you are rich you do not need a job, and/or you can afford to take your time finding the right job, and/or you can afford to take some time off from work for a while without the dread of the future pressing down on you and crushing every little moment of happiness you have during your break from the grind.

Slashdot Top Deals

"When it comes to humility, I'm the greatest." -- Bullwinkle Moose

Working...