Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
×

Comment Re:It is coming... On Weekends... From Home... (Score 1) 390

If your router enables IPv6, your devices have IPv6 access - no endpoint changes necessary. Current versions of most Operating Systems actually prefer IPv6 but fallback quickly. So it is likely to be turned on transparently.

There is no INTERNAL_IP6_ADDRESS, there is just an IP6_ADDRESS. The firewall blocks or permits dynamically (likely stateful connection management). The /64 subnet that is routed to your network is expected to be routed to the endpoint by your router if needed (modulo firewall rules).

The biggest issue for home networking is the lack of management of the router/firewall itself. You can't port forward (no config UI), you can't permit specific ports in most current home router implementations. However, configuration of ports and so on are not something that the vast majority of users know or care about.

Comment Re:How about basic security? (Score 1) 390

2: Attackers can view your entire IP space. A simple nmap scan, then choosing what zero days to use... instant pwn-ership.

Hmm... Non-direct allocated IP on your subnet, 64 bit subnet, pwn-ership aint that trivial. Scanning a 64-bit address space (AT&T allocates a full /64 to me at home) is going to be pretty obvious at the firewall.

Welcome back to the internet of the early 1990's we all lived on the internet with real IPs, but were protected from firewalls... This whole concept of everyone on a Class C/B/A private subnet thing has only been around for a couple of decades.

Comment Re:IPv6's day will come, but... (Score 2) 390

The main difference tech people will see is that they can't ping an IPv6 address from memory. mDNS (as in xyz.local) will become the only way to access another machine with any sanity.

Monitoring DNS at home, most services are already mixing (with a preference, but quick fallback from IPv6). So I'd say that the major websites are already primarily accessed via IPv6. You won't notice it.

It'll just take years...

Comment It is coming... On Weekends... From Home... (Score 5, Interesting) 390

I have IPV6 at home (took some calls to AT&T Customer Support). I don't have it at work, the migration will probably start small network endpoints (phones (apparently t-mobile has already switch), and home networks).

Link local IPV6 is already fairly broadly available - it's the fe80 prefixed address on your ifconfig output. You should be able to ping other ipv6 addresses on your network (*nix to *nix).

Google's IPv6 stats page indicates this too... https://www.google.com/intl/en... has a peculiar comb effect for the last few years. Zooming in seems to give a bit more insight. Google's count of IPv6 connections has a full 1% swing over the weekends vs the week days. Due to IPv6's addressing method, each unique device on your network appears as a unique device on the internet, vs the NATed IPv4 that we all know and love. This would also have an accelerating increase in the number of unique IPs that are visible on the weekend. I know I use more devices over the weekend (chromebook, phone, laptop, table) vs during the week.

Open to other insights, but our homes will be likely IPv6 before our offices are. (Of course aggressive tech companies like google and facebook are likely already IPv6).

Comment The danger of ngXYZ (Score 2) 232

The same thing happens with the hope for the "next generation" product solving all the ills of the current generation. Or the assumption that the code you have inherited was created by fools a number of years back.

The reality is that software has a set of maturity related bugs and a set of structural, intractable issues that are related to the design and architecture of the system. Each piece of software has it's unique set of intractable issues.

Software that has been in production has typically reduced it's maturity related bugs. The software built on top or that integrates with it is built around those intractable issues. When you move to a new piece of software - either a new architecture or the "groundbreaking ng version of XYZ", you end up with swapping a set of *known* intractable issues, for a set of *unknown* intractable issues plus a set of maturity related bugs.

Similar to TFA, the risks of old+known vs new+immaturity+unknown needs to have another factor similar to "value-add". If the value-add *really* adds a lot of stare the risks in the eye and march forward. If the value add is marginal, make sure the meta-benefits (performance, maintainability, etc) are clear and understood, otherwise you may be facing a train wreck of an upgrade.

Seen it many times, always wary of the ngXYZ project...

Comment Purple Unicorns and the Meat Grinder (Score 3, Interesting) 292

Reposting as a non AC.

There are some reasons for the unrealistic job descriptions, they are a lure, and are generally loosely associated with the role (ie: 80%). We're hoping for a purple unicorn, but know that they don't exist. But would settle for a winged horse, a unicorn, a purple horse or more realistically a good horse. But occasionally one of the unrealistic mix of experience does come through.

It has been almost a decade since I last went through an applicant list for a particular role.

What happens most times now is an application is added to an applicant tracking system. This parses the resume (from word, pdf or text) and creates a database of candidates matching keywords. This meatgrinder approach means that when I am looking to fill a position, I don't actually look for applications - I might - or the HR might quickly review the actual applications. What I do is search and screen. Search for a set of keywords, and from that list look for obvious issues (applicants to every job, rejected candidates, age of resume, etc). And then the HR recruiter will screen down from there.

I'll typically get 20 or so resumes to review. The recruiter may review 100 to 200 resumes. There pool of candidates may be 2000 to 3000 of which only a small portion are for my position.

This is part of the reason that resumes have gone from minimalistic to more fully descriptive with keywords sprinkled throughout them.

Comment Automation is Dependent on Design for Manufacture (Score 3, Informative) 187

I've been to Foxconn factories in Shenzen, and there are clearly opportunities for deeper automation. However, this will only be possible when the underlying hardware design has been designed for automation.

At the PCB level, pick and place achieves amazing automation and performance with smaller than rice-grain size components used in modern electronics. That is a given.

At the assembly level it isn't so easy to automate with a lot of the designs. There are flex cables, adhesive, torque sensitive screws that all rely on a human to be able to manipulate and then quickly respond to misalignment. To automate this, the design constraints placed on the Industrial Designs need to change. For low and mid-range products where form is not at the level of Apple integration, this will probably increase the automation. For the high end where every mm counts it's unlikely that there will be a high level of assembly automation.

Comment Round Hole, Square Peg.. (Score 1) 193

I'm not anywhere near knowledgable about medicine, but if the brain is larger, does the cranial cavity grow increase to the same level?

I wonder if there a round hole, square peg kind (big brain, small cranial cavity) of issue coming. The brains might be smarter, but they may suffer from decreased mental abilities from intracranial pressure.

Comment Able to Code != Professional (Score 1) 546

Title aside, the ability to code is a workplace requirement, and if you are not looking at traveling/work internationally, you aren't going to get very far without a degree.

Some of the "college drop out" success stories are no longer just coders. They are now C-Level executives, different rules apply. If you don't have a degree then in general you won't be eligible to get Visas to work in other countries.

Independent about how good you are, without a degree you are restricted to your local geography (country, etc).

Comment CVSS, CVE, CPEs and Policy (Score 1) 84

Define actions (instant, daily, weekly alerts) for ranges of CVSS scores http://nvd.nist.gov/cvss.cfm?c...

Track incoming CVEs (http://nvd.nist.gov/download.cfm) , assign CVSS scores specific to your organization. Also have a organization specific remediation approach.

As you find out who is using what software, and use the CVE CPE (http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2168) information to target more specific users.

In the blast emails, you could potentially harvest who thinks they may be affected to gather CPE information.

It's going to be a thankless, painful job, so you may as well automate as much as possible.

Slashdot Top Deals

What is research but a blind date with knowledge? -- Will Harvey

Working...