Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Comment Can Rust security blowup like Java? (Score 1) 45

I remember when Java came out in '96 it was this secure language that could do no wrong. The message to developers was that you could write everything in Java - a browser, an OS -- it'd be super secure.

Then a decade or two later, Java (JVM) vulnerabilities and security patches suddenly began trickling out. I thought, "that's strange"... only to see the trickle turn into a flood: alert after alert, patch after patch, Java browser plugins disabled etc. Java

Two questions:
1. Is there an underlying theme to the Java security issues? E.g, C++ code in https://access.redhat.com/secu...
2. Can Rust security blowup like Java?

Comment Re:The ISP should be the wallet provider (Score 1) 146

Sorry for the delay.

Yes, a trustworthy ISP with good competition from other ISPs is a good place to manage this.

This does not require breaking HTTPS.

Here's the idea:


  • 1>A person uses their ISP to browse example.com
    2>example.com makes the person an offer - remove ads for 50 cents/month.
    3>The person clicks a button to indicate interest
    4>Clicking the button submits a industry-standardised 'quote' document to the URL https://open.payment./ (1)
    5>Now this is where the ISP magic comes in. The DNS name 'open.payment' does not resolve to the same IP address all across the world. In fact, each ISP participating in the payment scheme resolves 'open.payment' to its own server. The ISP accepts the quote document on behalf of the account using example.com and enqueus the quote in its customer account portal. (2)
    6>The resultant page is served up by the customer's ISP. It gives the person the option to login to their ISP's portal and approve the quote. To defeat phising attempts, a sign-in seal is used (3)
    7>The account holder (who may be different from the person who initiated the quote) authenticates to the ISP's portal.
    8>The account holder reviews and accepts the 'quote'. This turns the quote into a valid 'order'.
    9>The ISP immediately transmits the order to example.com, which acknowledges it. This order may include information to complete user account setup.
    10>The ISP now owes 50 cents to example.com as the first month's payment. This may be paid to a designated account, or consolidated with other payments and remitted later to a clearing-house type of institution.
    11>The initial person browsing example.com should immediately be able to start using example.com without ads.
    12> (Complex scenarios) Usage by the account holder's entire household may be supported (without forcing users to log in)
    For instance, suppose the ISP detects new connections originating from this customer account are accessing example.com. The ISP can then send a new 'permit'
      document to example.com, specifying the source IP, port and timestamp of the new connection and quoting the previous order.

If the person's ISP does not support this scheme, they could use one of many virtual ISP that do, by VPN-tunnelling into them.

The ideas is built on plenty of previous precendent.

Precedents and previous work:
(1) Idea credit: Ariba cXML punchout carts. Like SAP OCI, these protocols return a quotation document to the originating user's system.
(2) Idea credit: Netgear routerlogin.net. Netgear Inc owns this domain. Netgear routers grab and reroute web requests to this address over to the local router's web-browser interface. That is, Netgear routers resolve the DNS lookup 'routerlogin.net' to the local router IP address (e.g. 192.168.1.1).
(3) Idea credit: Yahoo sign-in seal. This is a graphic pre-selected by the user to personalize their sign-in. It serves as a visual cue to help users confirm they are on the legitimate ISP page and not a phishing site.

Comment Yes, shoot the messenger! (Score -1, Troll) 25

And that would be the right thing too, if India Post refused point-blank to assist any bombing investigation citing privacy guarantees to customers. So no help investigating the postmark, no routing data, no helping locate a possible originating letter box. Who needs obtuse messengers like these?

So I hope ProtonMail can work out a sensible solution with the Government of India on this issue.

Comment Re:sounds a really bad strategy (Score 1) 106

"Firefox Desktop is in very good shape?"

Then why does the number of Firefox users drop steadily (not marketshare, but absolute numbers) over the past 5 years according to Mozilla itself?

https://data.firefox.com/dashb...

True, it is possible Firefox product performance, features and codebase are all in very good shape. And that the usage drop is due to extraneous factors. However, quality and uptake are generally correlated.

Comment No, most IT is ***not*** 24/7 (Score 1) 97

IT 'needs' and IT manager 'wants' are different things. Unless you support highly available systems like those in hospitals, nuclear power, ATMs, etc., then IT is not a 24/7 process and its support is not a 24/7 role.

Most organisations and businesses have a cadence where after hours or on weekends, the core business shuts down or slows. IT support requirements reflects that cadence.

Comment Re: Submitting to economic reality is not just gr (Score 1) 206

Yes you control data on-prem. And also have more control over compute.

  An example: I used an application that ran multiple components in a cluster. It was very sensitive to the multi-second compute 'gaps' that occur when its hosting VMs were automatically moved around 'live' from one blade to another by VMWare's 'VMotion' feature. (Effectively, this pauses a VM, moves it to another blade, then presses 'Play'). Some application components lost cluster synchronisation

Back in the on-premise VMware days I could sit down with our storage/VM admin guy and explain out constraint. He made the concerned VMs sticky to a blade. That way the 'VMotion' hardware load balancing would leave the problematic VMs alone and not shuffle them around when compute load was oversubscribed. Once a year or so, VMWare compute had planned maintenance. But we had months of notice about that. We had control.

That's not a possibility with compute in Azure cloud. With it's 'Freeze' and 'LiveMigration' events, compute 'gaps' are unavoidable and effectively unpredictable.

Comment Some of the coin goes to funding politicians (Score 1) 106

Some of the coin goes to funding politicians who pass laws that make it more difficult to regulate Bitcoin mining. Like that community in Arkansas where residents cannot sleep due to 24/7 whining of a bitcoin data center.

In the name of protecting liberty, these politicians force hundreds or thousands of poorly governed communities to pass and enforce new regulations and local laws. These local laws are much easier for the bitcoin investors to oppose.

Comment Re: Submitting to economic reality is not just gre (Score 1) 206

managers saying 'oh thank goodness we don't have to manage this anymore, it was tough!'

Hahaha ... I love this quote. The goal feeling seems to be: "We don't have to make real stuff anymore. We do electrons now, not atoms."

In IT, I see this sensibility with large companies on the move to cloud....

'oh thank goodness we don't have to manage data center hardware and fire suppression and storage and warranties and capex and UPSs and standby generators anymore, it was tough!'

To which this answer is _usually_ accurate:

"Yes, it was. But you managed. You built tools and processes and staff skills and that you got better value than you are getting now."

Slashdot Top Deals

Love may laugh at locksmiths, but he has a profound respect for money bags. -- Sidney Paternoster, "The Folly of the Wise"

Working...