Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Comment Re:No towers in range? (Score 2) 127

Usually, a terrestrial phone doesn't need to do anything much to "look" for a tower, besides keeping its receiver turned on. Towers emit beacons, and if you don't hear the beacon, there's no point in you sending anything - you won't receive a reply because you don't even hear the tower's beacon.

Indeed, many (most? all?) phones won't transmit at all unless they hear the tower's beacon, since it's possible they could have been moved to a jurisdiction where it is not allowed for them to transmit on certain frequencies they would otherwise use.

Of course, keeping the receiver powered to listen for the beacon does use a not-inconsiderable amount of power, so searching for signal will use more power than a phone that is connected to the network and idle.

Comment Re:Nuke it from orbit, then restore from backups. (Score 1) 150

If the keys are stored on the box in any way then they are compromised because the box is. The synology box is rooted, any information stored on that box is compromised. If for example your root key for S3 is backed up on the NAS then it's compromised.

Agreed. That's why you shouldn't use the root S3 access key for anything (in fact, don't generate one at all). Use service-limited, least-access keys for AWS accounts: there's no reason a NAS should have an access key capable of creating EC2 instances. It should have list+write access only to S3 (and/or Glacier). If users want to delete files from S3, they should have to log in with a different user (perhaps to the AWS console) and specifically do that.

Amazon provides good options in this regard, and it's too bad if users aren't taking advantage of them.

People are glossing over this, if the box is rooted everything it knows and stores is compromised, that's how people need to be analyzing this instead of blowing it off as no big deal.

In this specific case, the malware does not seem to want to steal user data, only to encrypt it and ransom it back to users. Sure, it could steal data, but it doesn't seem to do so. It's a big deal to those who are unprepared and don't have proper backups, but it could definitely be worse.

Comment Re:Nuke it from orbit, then restore from backups. (Score 2) 150

You do realize that for the S3 backup to work Synology or the NAS (and the NAS has you Synology login info) has your login information for S3, and that if this thing is owning the NAS there is a pretty damn good chance the malware has owned your S3 instance as well right? The only way it wouldn't is if the S3 backup is totally manual.

Amazon has a very extensive authentication system -- you can easily configure the Synology with an S3 access key that only has "List Files" and "Upload Files" permissions, but not "Delete Files" or "Overwrite Files". This way, even if the Synology box gets owned or a user fat-fingers something, the files on S3 aren't at risk. You don't (and shouldn't) need to use your AWS root access keys for S3.

I have a similar setup with Amazon's Glacier: my standard access key has only list, upload, and retrieve permissions. A separate access key is required to delete files (I've configured my Glacier client, FastGlacier, to prompt me for a password when I switch to the "delete" key) so that I don't accidentally end up deleting important backups.

Comment Re:Me too (Score 2) 113

I'd like something like this for a mixed Windows/Mac/Linux network but the costs are just prohibitive.

Yubikeys are $25 each for the hardware, and $45 PER USER. That's just ridiculous when you scale up, and there's an awful lot of manually faffing about to get to the point that it works.

Wait, what? Where do you get the $45 per user cost? I don't see that anywhere on their website.

The "YubiCloud" (where Yubico hosts the authenticator servers) has two modes: free and premium. The free service is open to everyone, even commercial users. The premium service offers an SLA and monthly usage statistics, and costs $3/YubiKey/year (1000-unit minimum).

You can also host your own local YubiKey authentication servers and keep things entirely in-house. Yubico has reference implementations for free on their site.

Comment Google Authenticator for software tokens (Score 4, Informative) 113

For software tokens, Google Authenticator has apps for Android, iOS, and BlackBerry. They implement the TOTP standard, so any compatible code-generating software (such as the J2ME app I have on my non-smartphone) will work with it.

They also have a PAM module that works with SSH (or anything else that uses PAM). I've used it before, and it works great.

For reference, neither the apps nor the PAM module depend in any way on Google services, they don't send any data to Google, and will work perfectly happily in a totally offline environment (assuming all the servers and client apps have synchronized clocks).

Comment Re:Simple Solution.... (Score 1) 140

The NRA has its deep pockets and resultant clout not (necessarily) from numerous individual private members but from effectively being an arms industry trade group, the USCoC of arms manufacturers and dealers.

The NSSF is the arms industry trade group. The private arms industry in the US is relatively small compared to, say, the oil, tobacco, alcohol, etc. industry and doesn't have anywhere near the same political clout as those industries. The largest source of income for the NRA is membership dues, and it's from their 5+ million members that they derive their political clout.

Comment Re: Maybe, maybe not. (Score 2) 749

Nothing unfortunate about it. That only affects the rich and powerful who for all purpose defraud american taxpayers and then shift the money offshore.

Why should any american have to suffer increased deficits and taxes so a tiny elite of wealthy parasites can continue to leach american money offshore

It also affects ordinary, non-rich-and-powerful people like myself: I'm an American PhD student in Switzerland and dealing with all the tax laws purportedly targeted at shady rich people (but which overwhelmingly affect ordinary people) is a massive pain and costs my wife and I several hundred dollars per year for a tax accountant to do our reasonably straightforward (i.e. we have some US investments, retirement accounts, etc. but earn all of our income in Switzerland) taxes.

Honestly, the whole thing can be resolved by making US tax law similar to that elsewhere in the world: pretty much all the other countries tax people based on their residency, not citizenship. That is, a Canadian living in Canada will pay Canadian taxes, but a Canadian living in Switzerland only pays Swiss taxes and owes the Canadian government nothing. Americans get taxed on their global income even if they don't live in the US (though there is a certain amount below which they're not double-taxed).

Comment DPScope (Score 1) 172

I have a DPScope and rather like it.

It's not a super advanced scope, and doesn't compare to standalone scopes like the Rigol DS1052E, but for someone on a budget who has fairly basic needs, it's worth a shot. It was developed by a guy who was annoyed at the drawbacks of other PC-based oscilloscopes and their software.

I use mine for testing homebuilt electronics, and it does well for that. I wouldn't use it for anything significantly more than that sort of stuff, though.

Comment Re:Off the Flight Path... (Score 4, Interesting) 264

Planes get lost, re-routed etc ALL the time.

Think a nightclub with laser advertising, plane flies overhead, or helicopter.

Can they be punished?

Major astronomical telescopes often use lasers for their adaptive optics systems. They coordinate with relevant authorities to insure they don't zap sensitive optics on satellites and post "plane spotters" outside so they can shut down the laser if a plane comes too close to the beam.

Of course, those lasers tend to be considerably more powerful (>5W) than handheld laser pointers (~5mW), so it might not be directly comparable, but I'd hope that any organization that is shooting lasers into the sky would have someone keeping an eye out for aircraft.

Comment Re:There should be only one mandate. (Score 1) 584

To have guns insured just like cars are, so that gun owners will always have enough funds to cover any damages that may ensue from mishandling the weapon.

If gun insurance coverage was mandatory then there'd be the right framework for a proper marketplace dynamics.

That's called "liability insurance" and is already included in typical homeowners and renters insurance policies -- the liability policy applies to incidents both on and off one's property. Pretty much everyone already has this (or should have it). It's quite inexpensive, and is typically less than $200/year for renters, so it seems that insurance companies have very little worries about gun owners.

That said, your analogy to car insurance doesn't make sense: the vast majority of car-related injuries and death are due to unintentional acts (i.e., accidents), which insurance will cover. The majority of gun-related injuries and deaths are due to intentional criminal acts, which insurance definitely will not cover. Those likely to go about committing criminal acts with their firearms are unlikely to have "gun insurance" anyway, regardless of if it's legally mandated or not. Your typical gun owner already has liability insurance through their homeowners or renters insurance.

Comment Re:Help! Help! (Score 1) 865

Try turning off a car with keys when the car is in drive.

Mostly doesn't work.

Always worked for me in various cars including a 1982 Volvo 240DL, a 1992 Mercedes 300D turbodiesel, a 2003 Honda Insight, and a 2006 Toyota Camry.

For clarity, I had tested these vehicles in a controlled manner, not an emergency situation nor on public roads.

Slashdot Top Deals

I'd rather just believe that it's done by little elves running around.

Working...