Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×

Comment Re:So ... (Score 4, Insightful) 93

"Wearable" isn't something bad by definition. It's just that the approach they take to it could not be worse.

Everything that runs towards "wearable" today is basically a reskinned, retooled and reshaped smartphone. That's not really what wearable computing can or even should be. A wristwatch that is essentially a smartphone has nothing to do with wearable. It's a smartphone in a different format. Where is the "wearable" benefit?

If you want to create a wearable, create something where we actually benefit from "wearing" it rather than sticking it in a pocket. The least I'd expect from a wearable is having my hands free and either a HMD or a output interface that doesn't require me to take my eyes off whatever I'm busy with. Else there is exactly zero need to "wear" the gadget, I can as well take it into a hand.

Comment Re:False sense of security (Score 2) 188

What I really don't like about the whole statement behind it is the implied assumption that closed source offered any kind of better protection.

You know what's the main difference between an OSS and a CSS audit? That I can't go "hey, psst, take a look at $code. Maybe you see something interesting..." to you when I find something in CSS software and someone in a badly fitting suit tells me to shut up about it.

Comment I think you're working from a few false assumption (Score 5, Insightful) 235

First, bugs in a given program are not infinite in number. By definition. Because the code itself is finite. Finite code cannot have infinite bugs. Also, due to the nature of code and how it is created, patching one bug usually also takes care of many others. If you have a buffer overflow problem in your input routine, you need only patch it once, in the routine. Not everywhere that routine is being called.

I have spent a few years (closer to decades now) in IT security with a strong focus on code security. In my experience, the effort necessary to find bugs is not linear. Unless the code changes, bug hunting becomes increasingly time consuming. It would be interesting to actually do an analysis of it in depth, but from a gut feeling I would say it's closer to a logarithmic curve. You find a lot of security issues early in development (you have a lot of quick wins easily), issues that can easily even be found in a static analysis (like the mentioned overflow bugs, like unsanitized SQL input and the like), whereas it takes increasingly more time to hunt down elusive security bugs that rely on timing issues or race conditions, especially when interacting with specific other software.

Following this I cannot agree that you cannot "buy away" your bug problems. A sensible approach (ok, I call it sensible 'cause it's mine) is to get the static/easy bugs done in house (good devs can and will actually avoid them altogether), then hire a security analyst or two and THEN offer bug hunting rewards. You will usually only get a few to deal with before it gets quiet.

Exploiting bugs follow the same rules that the rest of the market follows: Finding the bug and developing an exploit for it has to be cheaper than what you hope to reap from exploiting it. If you now offer a reward that's level with the expected gain (adjusted by considerations like the legality of reporting vs. using it and the fact that you needn't actually develop the exploit), you will find someone to squeal. Because there's one more thing working in your favor: Only the first one to squeal gets the money, and unless you know about a bug that I don't know about, chances are that I have a patch done and rolled out before you got your exploit deployed. Your interest to tell me is proportional to how quickly I react to knowing about it. Because the smaller I can make the window in which you can use the bug, the smaller your window gets to make money with the exploit, and the more interesting my offer to pay you to report the bug gets.

Comment Re:Not that good (Score 2) 188

Sorry, but no. Just because it produces them revenue doesn't mean they have an incentive to do it properly. They have an incentive to do it good enough that people buy it. That does not necessarily mean that the software is of high quality.

What is necessary to this end is that the software appeals to decision makers. They are rarely if ever the same people that are by any means qualified to assess the technical quality of code.

For reference, see SAP.

Comment Re:McArdle is astute (Score 1) 29

What worries me about her is that she was in charge of Clinton's single-payer plan, and screwed it up royally. So far I don't like any of the candidates from either major party.

Either way I'll probably vote either Libertarian or Green. I cannot support a candidate who wants me in prison. The only way she'll get my vote is if the Republicans screw up in their Presidential nominations like they did with Illinois' Governor's race. They had one excellent candidate, two acceptable and a tea party billionaire who hates unions and middle class people. They chose the only candidate who could get me to vote for Quinn.

Morons. They'll probably nominate another tea party stinker who only cares about the 1%. If they do I'll have to vote for Clinton.

Comment I noticed something once again (Score 1) 20

Why do so many right wing radicals (and supporting the 2nd amendment is in no way radical) insist on using, as they would put it, grocers apostrophe's? (Yes that was deliberate). There seems to be a correlation between far left and far right radicals and a lack of education.

User Journal

Journal Journal: Mars, Ho! Chapter Sixteen 3

Pressure
When I woke up, all my muscles were on fire. We would have had to turn the ship around today, and in fact that's what was scheduled, except for the meteors and the drama that followed.
Destiny was sleeping peacefully. I got up, thankful that we weren't at Earth gravity but wishing we had turned around for deceleration then, because they have it plotted so that you start the journey close to the planet you're leavi

Slashdot Top Deals

Happiness is twin floppies.

Working...