Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Comment Re:Oh great (Score 1) 549

Commonly used passwords are vulnerable to dictionary attacks, that doesn't change when you use passphrases.

Yes, it does, unless you do all the following:

  • Pick the words for your pass phrase from a small, well-known dictionary.
  • Follow the spacing expected by the attacker.
  • Use only the case the attacker expects (all upper, all lower, proper caps, etc).
  • Use only letters and spaces...no punctuation or special characters.
  • Don't do any substitution of characters (no l33t, etc.)
  • Spell every word correctly.

It's easy to create a phrase that is personal to you and won't appear in any Google search. But, even if it does, if you don't just use lowercase letters with the words run together, it will take a long time for the attacker to run through all the permutation tricks on a 40+ character phrase.

And here's a really good one...the part of your post that I quoted would make an excellent pass phrase, since it contains one word that isn't in the *nix words list. Something as simple as making a compound out of "pass phrase" is enough to cause an attacker pain if they use the wrong dictionary. And, when attackers start including every single "word" in their dictionary, it gets even closer to brute force. When you use "Tatooine" and "Mordor" in your pass phrase that doesn't in any other way reference "Star Wars" or LoTR, it's pretty secure: Tucson is hot, but it's no Mordor or Tatooine. Easy to remember, easy to type, but painful to crack.

Comment Re: symbols, caps, numbers (Score 2) 549

It's also a potential DOS for the server if a bunch of people start submitting preposterously long "passwords" anywhere they have a password box.

Nobody's asking for sites to allow you to use your favorite novel as a password, but limiting to some insanely short value is not the right way to solve the problem.

Set a limit of 255 characters for the password, and you won't get any complaints about too short a limit while keeping the computing requirements for the hash creation reasonable.

Comment Re:One quote *is* the story (Score 1) 478

this strain of ebola appears to have a 70% mortality rate.

Mortality rates for hemorrhagic fevers are often inversely proportional to the level of medical care available.

Keeping a patient cool and hydrated reduces mortality rate dramatically. Having antibiotics on hand to battle secondary infections is also a big plus. Even a supply of more powerful fever-reducing drugs than aspirin would be considered a luxury in many of the places where Ebola has a high mortality rate.

Comment Re:Ebola threat (Score 3, Insightful) 478

Uhh, she was in the process of undressing...

Then, correct procedures weren't followed.

For any truly infectious disease, proper procedure would have health care workers walk into a disinfectant shower (and possibly UV light) before removing protective clothes. Any disease that can survive that sort of thing is going to kill us all anyway.

Then, order of removal is important. In general, headgear is removed first (preferably by another person), then outer gloves, then fasteners released and gear removed, then inner gloves. All this is followed by hand washing (at a minimum). This makes sure that easier paths to infection get as little possible contact from anything that might have had contact with the pathogen.

The nurse screwed up by touching her face with her outer glove, and I suspect that disinfectant showers/UV were not done first.

Comment Re:It's okay when I do it... (Score 4, Informative) 429

Don't get me wrong, I think BitTorrent is very cool technological achievement. But transferring data between semi-random hosts around the globe and opening hundreds of TCP connections per computer while doing it, is like the ultimate way to clog the pipes.

BitTorrent uses UDP when done correctly, and pretty much becomes the absolute best way to get data to many computers very quickly.

A torrent with few seeders isn't very efficient, but one with many hundreds of well-configured peers is hard to beat on overall transfer speed.

Comment Re:Google & ISC have MeasurementLab.NET (Score 1) 294

http://www.measurementlab.net/...

Unfortunately, the number of ridiculous hoops you need to go through to let an unsigned Java applet run an arbitrary network I/O makes it much less useful.

They now have a Flash version as well, so it's easier. But the numbers appear really low, claiming that my network buffer limits download to 140Mbps, yet I have often downloaded actual files from the Internet at faster than that.

OTOH, all the Ookla-powered sites claim I get over 70% of my 1Gbit network card speed, which I also find hard to believe, despite having a 20Gbps connection to our ISP (with literally thousands of users, one of which is a server I maintain that downloads at over 2000Mbps 24/7 backing up a remote site).

Comment Re:DIY test (Score 1) 294

Saturating my download is simple, it's my upload that's hard.

You could also try for total composite speeds by using a bunch of torrents. My seedbox regularly runs 40Mbps total upload speed on the 50+ torrents, even though no one torrent is running that fast. I actually throttle the max upload to 50Mbps to allow 30Mbps free bandwidth to FTP the files to my home.

Comment Re:hum (Score 2) 774

I'm relying on the very vocal detractors of systemd to be sufficiently competent to install the init system of their choice because they are adopting the position of saying they are smarter and better than the developers of systemd.

No, we're adopting the position of "if it ain't broke, don't fix it" and "provide your supposedly better solution as an alternative and let it win on its merits".

Comment Re:It's a classic... (Score 1) 304

Soft keys but with great tactile feel, and completely programmable so you could easily swap the CTRL and CAPS LOCK keys. It was IBM's take on a silent keyboard but will all their (then) quality thrown in.

Like most keyboards, it has the function keys at the top, and the inverted-T arrow keys. These are the two things I absolutely hate, and why I have Northgate keyboards, like the Omnikey Ultra and the Omnikey Plus. Unfortunately, there were multiple versions of both of these keyboards, and some have the inverted-T.

But, the programmable keys are nice, and the Model M needs that as it suffers from the Caps Lock key being next to "A". I use Caps Lock so infrequently that I programmed it to be the Windows key (which my Northgates don't have).

Comment Re:Bottom line: is Systemd popular with Linux user (Score 1) 774

I haven't seen a lot of pressure yet. With RHEL6 the urge to switch came on fast. Esp with regards to virtualization and what not. I haven't gotten the sense that RHEL7 has a whole lot of "must have now" tech in it, as opposed to the amount of systemd fear it has.

We're a mixed shop, running CentOS 6 and Ubuntu LTS (12 and upgrading to 14). We will not be upgrading to any version of either distro that has systemd until at least a year after release, and maybe even later, despite the fact that upgrades to LTS 14 happened within a month of release for many of our systems.

Comment Re:Slashdot Response (Score 2) 774

Yup - it's not SystemD's fault for solving this problem first.

It's systemd's problem for solving it in a non-portable way.

If I could download a replacement "VTd" package, install it, and get the new features, that'd be great. Unfortunately, I have to replace the Linux kernel (so that the VTs there don't complete with systemd's version) plus replace config files for a bunch of other services that systemd replaces, plus verify that my startup scripts work with systemd, plus.... Get the point?

Comment Re:Shut up and listen... (Score 1) 774

This is not just a systemd problem, this is a problem for any init system that wants to support multi-seat, and sane switching between VTs:

I have no idea what you mean by "multi-seat", but the existing SysV init system has no problem with simultaneous logins from any number of users.

If you mean hooking up multiple keyboards and monitors to the same system at the same time, why would you ever want to do that when you can just log in to the system over the network (text or GUI, your preference).

Slashdot Top Deals

Genetics explains why you look like your father, and if you don't, why you should.

Working...