Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×

Comment Can Rust security blowup like Java? (Score 1) 45

I remember when Java came out in '96 it was this secure language that could do no wrong. The message to developers was that you could write everything in Java - a browser, an OS -- it'd be super secure.

Then a decade or two later, Java (JVM) vulnerabilities and security patches suddenly began trickling out. I thought, "that's strange"... only to see the trickle turn into a flood: alert after alert, patch after patch, Java browser plugins disabled etc. Java

Two questions:
1. Is there an underlying theme to the Java security issues? E.g, C++ code in https://access.redhat.com/secu...
2. Can Rust security blowup like Java?

Comment Re:The ISP should be the wallet provider (Score 1) 146

Sorry for the delay.

Yes, a trustworthy ISP with good competition from other ISPs is a good place to manage this.

This does not require breaking HTTPS.

Here's the idea:


  • 1>A person uses their ISP to browse example.com
    2>example.com makes the person an offer - remove ads for 50 cents/month.
    3>The person clicks a button to indicate interest
    4>Clicking the button submits a industry-standardised 'quote' document to the URL https://open.payment./ (1)
    5>Now this is where the ISP magic comes in. The DNS name 'open.payment' does not resolve to the same IP address all across the world. In fact, each ISP participating in the payment scheme resolves 'open.payment' to its own server. The ISP accepts the quote document on behalf of the account using example.com and enqueus the quote in its customer account portal. (2)
    6>The resultant page is served up by the customer's ISP. It gives the person the option to login to their ISP's portal and approve the quote. To defeat phising attempts, a sign-in seal is used (3)
    7>The account holder (who may be different from the person who initiated the quote) authenticates to the ISP's portal.
    8>The account holder reviews and accepts the 'quote'. This turns the quote into a valid 'order'.
    9>The ISP immediately transmits the order to example.com, which acknowledges it. This order may include information to complete user account setup.
    10>The ISP now owes 50 cents to example.com as the first month's payment. This may be paid to a designated account, or consolidated with other payments and remitted later to a clearing-house type of institution.
    11>The initial person browsing example.com should immediately be able to start using example.com without ads.
    12> (Complex scenarios) Usage by the account holder's entire household may be supported (without forcing users to log in)
    For instance, suppose the ISP detects new connections originating from this customer account are accessing example.com. The ISP can then send a new 'permit'
      document to example.com, specifying the source IP, port and timestamp of the new connection and quoting the previous order.

If the person's ISP does not support this scheme, they could use one of many virtual ISP that do, by VPN-tunnelling into them.

The ideas is built on plenty of previous precendent.

Precedents and previous work:
(1) Idea credit: Ariba cXML punchout carts. Like SAP OCI, these protocols return a quotation document to the originating user's system.
(2) Idea credit: Netgear routerlogin.net. Netgear Inc owns this domain. Netgear routers grab and reroute web requests to this address over to the local router's web-browser interface. That is, Netgear routers resolve the DNS lookup 'routerlogin.net' to the local router IP address (e.g. 192.168.1.1).
(3) Idea credit: Yahoo sign-in seal. This is a graphic pre-selected by the user to personalize their sign-in. It serves as a visual cue to help users confirm they are on the legitimate ISP page and not a phishing site.

Comment Yes, shoot the messenger! (Score -1, Troll) 25

And that would be the right thing too, if India Post refused point-blank to assist any bombing investigation citing privacy guarantees to customers. So no help investigating the postmark, no routing data, no helping locate a possible originating letter box. Who needs obtuse messengers like these?

So I hope ProtonMail can work out a sensible solution with the Government of India on this issue.

Comment Re:sounds a really bad strategy (Score 1) 106

"Firefox Desktop is in very good shape?"

Then why does the number of Firefox users drop steadily (not marketshare, but absolute numbers) over the past 5 years according to Mozilla itself?

https://data.firefox.com/dashb...

True, it is possible Firefox product performance, features and codebase are all in very good shape. And that the usage drop is due to extraneous factors. However, quality and uptake are generally correlated.

Comment No, most IT is ***not*** 24/7 (Score 1) 97

IT 'needs' and IT manager 'wants' are different things. Unless you support highly available systems like those in hospitals, nuclear power, ATMs, etc., then IT is not a 24/7 process and its support is not a 24/7 role.

Most organisations and businesses have a cadence where after hours or on weekends, the core business shuts down or slows. IT support requirements reflects that cadence.

Slashdot Top Deals

Force needed to accelerate 2.2lbs of cookies = 1 Fig-newton to 1 meter per second

Working...