Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
×

Comment Re:Number 5 (Score 1) 51

Sorry, but no. For example, one of the most important threats these days in the banking industry is data leakage. No amount of input data validation is going to help one bit there. These aspects are all critical. Mess up one, and all is lost. That is what makes software security so difficult: You have to master the whole problem space before you can produce good solutions. Incidentally, there are rules "11: Always consider the business case" and "12: Do a conclusive risk and exposure-analysis and rate and document your findings" which are the make-or-break aspects and it are completely missing from the list.

Comment Re:Among the other areas of secure design... (Score 2) 51

You can. But you need to be aware that 99.9% of people doing PHP or Java or the JVM do not have what it takes to make anything that may see real attacks secure. People that can secure things in this particular problem space are exceedingly rare and exceedingly expensive. One problem is that you cannot use most/all libraries for security critical functions, and may well have to augment the JVM via JNI for secure input validation. Most Java folks are not capable of doing that at all.

Comment This initiative is futile (Score 1) 51

While the brochure referenced is nice, anybody that needs it has zero business building anything security-critical. It does take a lot of experience and insights to apply the described things in practice in a way that is reliable, efficient and secure and respects business aspects and the user. Personally, I have more than 20 years of experience with software security and crypto, and looking back, I think I became a competent user, designer and architect only after 10 years on this way. The problem here is that as software security is very hard, a specialized form of the Dunning-Kruger effect applies. The things I have seen people do that though they understood software security are staggering. Unless you have achieved a holistic view of the problem-space, do not even try to design any security critical software.

Comment Re:Better Idea (Score 1) 64

But you can't then just leave the printed document in the tray. That's not secure. You need to have a shredding module attached so that after the email is sent the original can be destroyed.

Well, maybe, but neither the sender nor the recipient knows anything about the various other addresses that have received a copy of the document, plus information on the send/receive times.

It's not clear how any of this could be made secure to either party's satisfaction. If the printer can decode the document and make a legible copy, it can also forward the electronic version of that copy (and/or the decoding keys) to a third party.

Comment Re:"Moderation?" Don't you mean "Censorship?" (Score 1) 76

Call me cynical, but I just don't see Facebook adopting a sane moderation system, like for example anything that approximates slashcode. Their equivalent of "moderation" would better resemble censorship. They would simply hide the thoughts and comments they don't think you would like. Of course, it would be for your own good...

It's likely that a portion of the story is something that we also see here on /.: None of them really support anything that might be called a true "discussion". The reason both here and FB and the other "social media" is the approach of having a running string of "latest" topics, which quickly scroll off the bottom and out of sight. If you don't happen to see a thread in the first hour or so, you generally won't ever see it, and won't contribute to it. So, except for a few rabid topics like religion or partisan politics, where a small group can have fun running it out to thousands of rephrasings of each person's personal views, most discussion threads are typically shallow, and peter out at a depth in the single digits.

I've talked to a number of people here who express disappointment at how shallow the /. discussions usually are. They start of hoping to find in-depth analyses that point them to information that they hadn't run across or noticed. But they're disappointed with most of the threads, which only repeat a few things that those familiar with the topic already know, and then the threads just stop.

FB is quite a lot worse this way than /., of course. I've been on it for some years, and I've never noticed a "discussion" that got to depth greater than 3. I'm sure they exist; I've just never seen them. And a lot of my friends are quite well-informed "geeks" who in person can engage in long discussions. Why don't they do this on FB? Well, they may try, but quickly learn that few people ever read, much less reply to, their comments. Over here, we do sometimes get a bit deeper than that, and I've seen a lot of good information here at depth 5 or 6. But still, that's not very deep as discussions go.

I've seen much better (i.e., deeper and more informative) discussions on nearly every mailing list I've been on. If you want actual informative, socially interactive discussions, that's a noticeably better model for a forum's structure.

But the "social media" is primarily just an electronic form of the old "see and be seen" sort of social event. Such things have always been known as shallow and uninformative, although they can be fun if populated by the right crowd.

Comment Re: Say what you will but this is cool (Score 1) 52

So where does the liability lie when these things fall out of the sky, or collide with helicopters, planes, trains or automobiles? How will they "innovative" around that?

Where does the liability lie when a UPS truck backs over a baby stroller, or a FedEx delivery person loses control of a handtruck full of boxes and breaks someone's ankle? Where's the liability when an aircraft flown by DHL crashes short of the airport and burns a row of houses to the ground?

You make it sound like small plastic/foam flying wings with four battery-powered motors are the first dangerous thing that business has ever considered operating, and that there's no such thing as the liability insurance industry. Which means you're clueless about the real world, or just trolling. Or both.

Comment Merkel Indicates German Wish for Federal Ukraine (Score 1) 848

This also from an interview Merkel gave to public German TV yesterday:

A solution must be found to the Ukraine crisis that does not hurt Russia and which the Ukrainian people must choose for themselves, German Chancellor Angela Merkel said on Sunday.
...
  "There must be dialogue. There can only be a political solution. There won't be a military solution to this conflict," she said.
...
  On Saturday, her vice chancellor Sigmar Gabriel had suggested that establishing a federal Ukraine was the only viable solution to the crisis pitting Kiev against pro-Russian separatists.

Merkel said that if Ukraine opted to rejoin the Eurasian Union with Belarus, Kazakhstan and Russia, then Europe would not make "a huge conflict" out of it.

Especially the last point is clearly a big step back from the earlier all out "Ukraine is EU" position.

Additionally to the economic side, pressure on Merkel also grows because there is more and more doubt, even in German mainstream media, about the veracity of the Ukrainian propaganda and about the destruction of flight MH17. Why is there is no news about it? Is there a coverup (in German)?

Comment Re:Patents cited in article (Score 1) 30

The linked article cite the following patents : - Auto-correction/completion on keyboard entry... Il looks quite similar to the autocompletion that you find in some Japanese IME under Linux... which sometimes allow both conversion to kanjis and completion. Auto-correction is quite old on the wordprocessor scene - transformation of email & phone numbers to link AFAIK, most forums and webmails already convert email to link for a long long time. As for Phone number, the extension is quite trivial - slide to unlock it's mimicking a physical (door) lock... so nothing real new...

In hindsight, everything looks trivial. That's why you need to find actual prior art that invalidates the claims. And in particular, mimicking something in the real world may still be patentable, if the patent goes to the method of how it's mimicked. For example, we're trained from birth to recognize faces, but would you say that a facial recognition technology for a computer would never be patentable, because it just mimics that real-world ability? No - it depends on what's actually in the claims, and whether they go to how that simulation is implemented, rather than just the general idea of "recognizing faces" or "unlocking something".

Comment Re:Except (Score 1) 18

You see what you want to see.

Just one point: Africa is in the aftermath of Colonial destruction and neon-colonial extraction. That has far more relevance than the practice of religion.

All people on earth are made of the same mixture of inclinations and inspirations. The mental proposition of a theology does little to change this, but provides one framework for justifying how desires are fulfilled.

God's grace arrives as a mystical occurrence, not the mental and emotional identification with theological proposition. "Morality" is how one behaves towards the creation, so that the opportunity to recognise the arrival of this grace is not clouded, or missed. Nobody can direct God, all are at the quality of absolute mercy. That is the root of real humility - the moral virtue from which all others are sustained.

Comment Re:NOT LULZ - LIES ! (Score 1) 848

Angela is not saying this anymore. Russia as resources and markets is necessary for an Industrial Germany. A de-industrialized US? Not so much...

The Kiev government are a coalition of hyper-rich oligarchs, wielding explicitly fascist militia. It is like Goldman Sachs running a country with the help of Blackwater and the KKK. The US is involved to own the gas-pipe to Europe. Look at where Joe Biden's son is, and what he is doing.

As to a WMD Neo-Con-Job?

The NATO commander making accusation, and touting photos no one has seen? He declared Saddam's WMD as "fact".

The NYT "reporter" putting this into public record? Co-author with Judith Miller on the famous lies of 2003.

Slashdot Top Deals

Systems programmers are the high priests of a low cult. -- R.S. Barton

Working...