Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×

Submission + - SAIC has data theft effecting 4.9 Million people (informationweek.com)

An anonymous reader writes: Government contractor SAIC just can't seem to get a break. Still fresh off of the Citytime scandal (http://yro.slashdot.org/story/11/06/30/2025206/nyc-mayor-demands-600m-refund-on-software-project) they have now had a data breech where backup tapes of 4.9 Million personnel health records were stolen out of an employees car overnight. To add insult to injury, evidently the tapes were not encrypted either: "Tricare did not indicate whether SAIC encrypted the information on the stolen tapes, but Raley said, "It's very hard to encrypt a backup tape.""

Submission + - Ask Slashdot: Are you "opting out" of .xxx? 2

davesque writes: I'm working as a web developer for a company in my home town. Recently, we got a letter from our lawyer stating that, from today until October 28th, we have the opportunity to file an "opt out" application to the icm registry. This would prevent anyone from registering adult (.xxx) domain names with similar names to the ones that we own. I'm not sure what we should do. On the one hand, it would be good to block this from happening. On the other, we're not a very big target and it also seems bad to have our information tied in with a ".xxx" domain in any way (like in a WHOIS registry, for instance). It seems like this might be a risk if we file an "opt out". What is everyone else doing about this?

Comment Simple solution: Do not bundle the apps and OS (Score 1) 284

They need to separate the applications from the OS the way every other operation system does (eg. BSD, OSX, Windows, etc).

So you have a core system which is just the most basic requirements to run the OS. Kernel, utilities, display, web browser, etc. I would do it like the BSD's where you have a kernel core, x-windows core, etc. No large apps like OpenOffice and all the other crap. Those can and should be installed separately by the user like they do on every other system.

Then you just maintain and have releases of the core like everyone else does. This is much less work and allows for more focus and higher quality.

The general applications can be done as a rolling release or whatever the user wants. Separate from the core.

Comment Re:Bad passwords are not always the user's fault. (Score 1) 276

This is exactly the type of thing a smartcard would be good for. You could have all unique passwords using the strongest randomizer possible (or use PKI or similar) and only have to remember a simple PIN for your card. The PIN can be relatively short and simple too (although making it more complicated is recommended).

A smartcard provides a hardware level of protection as it's much more difficult to brute force because it can be set to self destruct after a certain number of bad PIN attempts. Usually between 3 and 8 attempts will "permanently" block the PIN. Many cards do also have an unblock PIN and/or transport key but those will also block after some low number of attempts, at which point the whole card will probably be permanently "bricked."

It's not some magical solution to all problems because unless you're using PKI then your password has to be read off the card and transmitted but the range of attacks is much smaller (mostly limited to local attacks on your system versus stuff like the Sony breach).

Comment Re:Minimalist trend (Score 4, Insightful) 216

It's just a fad. It's very similar although not exactly the same as "Not Invented Here" syndrome caused by developer inexperience and naivety.

Although this has happened countless times the primary example I like to take out is Java. Java tried to be minimalistic and "simple" by leaving out all sorts of useful functionality (eg. generics, etc). Now look at it, everything they left out in the beginning is shoehorned into the current versions and it sucks because they failed to account for the functionality in the original design.

What will happen is these products and projects will start out very minimalistic but will then slowly grow into a bloated, poorly designed pieces of shit as the developers realize that some features exist for a reason and are actually needed or just plain useful.

Then there will be backlash against the "idiotic" minimalist approach and we will start to get over-designed, over-complicated, inefficient, bureaucratically designed, and slow to implement bloatware which will slowly shrink into buggy poorly designed pieces of shit as the developers realize that you can't start giant designs and implement the whole thing at once.

Then there will be backlask against the "idiotic" over-complicated software so... (this is what is happening now)

Repeat ad nauseum. Einstein had it right: "Make things as simple as possible, but not simpler." You need to start with a solid flexible, possibly somewhat complicated design but with the intent and proper planning to only implement a simple subset of the design at first. Then it can grow into the full-blown design over time.

Comment Alternatives? (Score 1) 151

Anyone know of any alternatives that will let me sync my Android phone with all the information I do now? Calendar, phone book, installed applications, bookmarks, etc. It is really handy whenever I wipe my phone or get a new one, everything just magically transfers over. I was even able to cross devices when I switched from Symbian to Android, because I was using the Symbian Google syncing stuff.

I hate that Google has all that information but it's just so damn handy. There is no reason why I couldn't run my own server for that though. Something open source and Linux based would be good.

Comment Re:Following Google to Stupidity (Score 1) 591

I don't care if they disable it be default as long as there is some officially supported way to turn it back on.

Many normal users are confused by URL's and the like anyway so removing it might be a good idea as long as "power" users have a way to keep doing what they can do now (unlike GNOME3, Unity, and the other crap that effectively cripples the system for people that know what they are doing).

Comment They may be solutions (Score 1) 309

I'm experiencing none of these issues while running a non-stock setup:

Rooted HTC G2 running CyanogenMod 7 (Gingerbread 2.3.3). The DHCP server I tested against is a WRT54GS using Tomato 1.28 firmware.

With my setup the phone renews the DHCP lease when it reaches 50% of the expiration time if it is already connected. If it is not connected when the lease expires then it renews it correctly when the next connection is made.

Comment In most contexts this would be illegal (Score 5, Insightful) 519

You can't set traps for people even if the only way they would be harmed by it would be because they themselves are doing something illegal.

This does "harm" the person running the illegitimate app because it may cost them money to send all those messages plus any potential fallout from people thinking they are a software pirate.

Comment Re:So...obvious solution then? (Score 4, Interesting) 98

Actually most people are using G.711 these days which is in fact a fixed bitrate (it's the same protocol used on your normal "hard" voice line).

But most VoIP providers do not offer SRTP or any encryption whatsoever so this whole thing is not even a question. More than likely anyone can listen in on your VoIP calls. We need to put more pressure on VoIP providers to offer encryption.

Comment Re:Quake Live works... (Score 2) 95

Quake Live doesn't run in the browser. It launches from a browser but the game runs in a native browser plugin so it's not like Quake Live is and HTML5 game or something.

I personally wonder how companies expect to make money from games when they are giving out the source code. If your game is truly browser based (ie. written in Javascript and HTML) then everyone has the source code to the client-side code of your game. That's a lot of IP you're just giving away for anyone to copy and use in their own games.

Comment Re:Common Sense (Score 1) 279

It should work that way though, it's too hard to look through all the crap before even using the app. You don't know why it needs some stuff.

For anything that costs you money it should pop up a dialog the first time. Like "XXXX application wants to send a text message. Allow? Yes/No/Always allow".

Then you know the context in which it wants to use something that costs money.

Slashdot Top Deals

To understand a program you must become both the machine and the program.

Working...