Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×

Comment Not Likely Reproducible in Production Environment (Score 5, Informative) 73

Before anyone gets carried away, here are a few important quotes from TFA:
  • "We assume the attacker knows the software running on the victim VM and has access to a copy of it"
  • "We demonstrate how to use interprocess interrupts (IPIs) to abuse the Xen credit scheduler in order to arrange for frequent interruptions of the victim’s execution by a spy process running from within the attacker’s VM...[then much later]...we leverage the tendency of the Xen credit scheduler to give the highest run priority to a VCPU that receives an interrupt."
  • "We will only be able to spy on the victim when assigned to the same PCPU, which may coincide with only some fraction of the victim’s execution."

In other words, this exploit requires: knowing what cryptographic software is being run, the presence of Xen and an apparent security hole therein, and lucky core colocation of the VMs in an environment that could easily have dozens of VMs running against more than a dozen cores "over the course of a few hours".

In short, all of this is unlikely to be reproducible outside of a lab.

Comment Insecticides and Bees (Score 5, Informative) 141

The value and challenges of hydroponic farming might not be obvious to those of you in the west (I live in Singapore).

First, the local vegetable market is dominated by Malaysian and Chinese imports. Both of these countries have questionable laws limiting the use of pesticides and fertilizers. I have no doubt that their products are grown unsustainably. Most people wash Chinese vegetables with soap for fear of the chemicals that may remain on them.

Those imported vegetables are incredibly cheap locally. Its possible to get all the food you need for a stir fry for a small family (with meat) at a local wet market for just a few dollars. But, as I said above, the safety of that food is dubious. Singaporeans are now rich enough (average income second only to Japan in Asia) to expect a better quality of food.

The one vegetable that we simply cannot get in quality is the tomato. Most are flown here under ripe so they do not crush in transit. Of course the carbon footprint of those tomatoes must be massive. The higher quality ones come from Japan, but apparently were shipped frozen. Tomatoes are mushy, mealy, and never taste like a proper tomato picked in southern Europe's late summer. Sky green's web page shows they are only tackling non-flowering vegetables (greens). This is probably because they are not able to farm the bees needed for tomato pollination. I've never seen a bee in Singapore and don't know what the concerns are of raising honey bees on the island.

Just a few thoughts from an American in Singapore...

Comment A Cure for Citizens of Countries with No Internet (Score 1) 165

While the CIA has a pretty terrible track record with respect to third world citizenry, one has to give credit to the ostensibly altruistic internet in a suitcase. It would be an excellent "weapon" in situations like this where the ability to connect would support a movement of the people, whether it be aligned with USA interests or not.

Comment Gearing Up for War With China (Score 1, Insightful) 400

I feel the drumbeat of war with China beating steadily. Its been getting louder since the fall of the USSR.

The military industrial complex that Eisenhower warned the US about is focused on China. Its using China to justify its existence. It needs China to sustain its budget. And I think it is subtly behind the propaganda that got this author to suggest the weapons development is focused on China.

We could say China has been around 60 years or 2000 years. But in either case, China has has a pretty good track record of not engaging in wars that were not within or adjacent to its borders. In 60 years the US's can make no such claim. That the US would need a bomber to strike targets in China "for self defense" is not reasonable. And suggesting that the US would be in a defensive war against China flies in the face of what we know about Chinese ambitions.

Comment Trust Scientists (Score 2) 409

Something immediately pops into my mind after reading this article. This is for the readers of /. as much as a statement to the general "anti-science" public. It was the research of scientists that brought this anomaly public for discussions. Next time, before you go accusing scientists of running an "environmental agenda", remember that it was them that had the guts to offer a tidbit of evidence suggesting a circumspect opinion on the problem.

Comment Re:This Is a Non-Story: Chinese Firewall Easily Be (Score 2) 32

First, even if you were right (which you are not) my estimated $2/month cost for unrestricted internet comes out to 1.3% of monthly income. A small--but not insignificant--amount to pay for unbridled access to information.

But your number was incorrect. China earned in $12/day nationwide in 2004. And, more apropos to the discussion, China's urban citizenry is brought home $20/day in 2004. It is beyond dispute that the average income in China has increased dramatically since 2004.

My point is that $2/month still represents the relatively small contribution of 0.5% of the average urbanites' monthly income in 2004. The relative cost is at least half as large today.

To repeat myself: the cost of unfiltered internet in China is very small. New broadcasting mechanisms are an inconsequential contribution to the current availability of unrestricted information.

Comment Virus Control Improvements (Score 5, Interesting) 60

In 2006 or so I went to a conference in Redmond (WinHEC, I believe) where one of Microsoft's security team managers presented and overview of the virus threat to the desktop market. One of the things Microsoft had recently learned is that the majority of exploits were coming from hackers that had reverse engineered Windows patches to identify where Microsoft was correcting buffer overflow issues. Based on that knowledge, hackers knew un-patched versions of Windows could be exploited.

The strategy at MSFT became somewhat simple at that point: minimize the time between a security update's release and its application on 100% of networked computers. The presenter could show that MSFT had brought this average time down from months to weeks back then. Its clear to me that Microsoft has continued to make gains in this space over the years.

Lastly, the presenter showed that the exact same process applied to Linux. Few hackers find vulnerabilities to poring through an entire operating system's code base. They reverse-engineer patches and then hunt for un-patched systems. Microsoft claimed to be ahead of Linux in their ability to mass-apply security patches and he showed results that a Linux honeypot would be compromised slightly quicker that Windows, although not significantly so. I found the author credible in his data but recognize that he had an agenda with his presentation.

Slashdot Top Deals

"When the going gets tough, the tough get empirical." -- Jon Carroll

Working...