Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
Security

Submission + - Sophos A/V riddled with vulnerabilities (pcworld.com)

arglebargle_xiv writes: Security researcher Tavis Ormandy has had a look at Sophos A/V and found that it'll actually make your system less secure after you install it:

The paper contains details about several vulnerabilities in the Sophos antivirus code responsible for parsing Visual Basic 6, PDF, CAB and RAR files. Some of these flaws can be attacked remotely and can result in the execution of arbitrary code on the system. Ormandy even included a proof-of-concept exploit for the PDF parsing vulnerability which he claims requires no user interaction, no authentication and can be easily transformed into a self-spreading worm.

The findings also include this gem:

Ormandy also found that a component called the 'Buffer Overflow Protection System' (BOPS) that's bundled with Sophos antivirus, disables the ASLR (address space layout randomization) exploit mitigation feature on all Windows versions that support it by default, including Vista and later.

Original paper here.

The Internet

Submission + - Ask Slashdot: What is the best way to become a rural ISP? 1

hawkeyeMI writes: "I live in a small, rural town nestled in some low hills. Our town has access to only one DSL provider, and it's pretty terrible. However, a regional fiber project is just being completed, and some of the fiber is in fact running directly past my house.

Currently, there are no last-mile providers in my area, and the regional project only considers itself a middle-mile provider, and will only provide service to last-mile providers. Assuming this will not be my day job, that the local populace is rather poor, and that because of the hills, line-of-sight service will be difficult, how could I set myself up as an ISP? I have considered WiFi mesh networking, and even running wires on the power/telephone polls, but the required licensing and other issues are foreign to me. What would you do?"
Microsoft

Submission + - Microsoft Shutting Down Messenger (bbc.co.uk)

Entropy98 writes: "Windows Live Messenger will be shutdown by March 2013 after nearly 13 years so that Microsoft can focus on Skype its recent $8.5bn acquisition. No word on whether users will be able to transfer their WLM accounts to Skype."
Government

Submission + - Voting Machines Should Be as Secure as Slot Machines (networkcomputing.com) 2

CowboyRobot writes: "The problems with elections in the U.S. are well-known, yet we seem to need reminding every four years about how bad it's getting.
Howard Marks at NetworkComputing has an essay, pointing out exactly what we need for reliable, accurate voting:
"A valid audit trail, such as a printed ballot the voter can verify; A mechanism for recounting the printed ballots on a machine made by another vendor so the results can be compared; and An audit of the software by an independent third party to insure that the software accurately records and tabulates the voter's true intent."
He then looks at his own experience working with casinos, who would never tolerate the kinds of problems voting machines have. So why not take a lesson from gaming machines and build voting machines the same way?
"The slot machine industry is several times bigger, and significantly more competitive, than the voting machine industry. If IGT, Bally's and Aristocrat can compete for the slot market, then Diebold and Election Systems and Software can stand the same level of scrutiny.""

Cloud

Submission + - Cloud Computing Needs to Embrace the Linux Model: Rackspace CTO (slashdot.org)

Nerval's Lobster writes: "Companies are rushing to lock customer data into their specific walled gardens, Rackspace CTO John Engates argued in an interview after a Cloud Expo keynote in Silicon Valley. That makes it more important than ever to ensure that the cloud undergirding all the various functions of daily life remains open. “These companies have grown up in the era of enterprise software and they’re addicted to enterprise software margins, magnitudes more profitable than what we make as a hosting company,” he said. “Now you have software companies embracing cloud computing and taking the same enterprise-software playbook they’ve had for years and trying to run it in the cloud.”

Ultimately, he added, cloud computing needs to adopt the Linux model. “Linux opened it up and gave you vendor choice, with numerous vendors bringing their own strengths to the table.”"

Australia

Submission + - Boxed copies of Windows 8 Pro do not work for clean installs

excatholica writes: After confusion at the Australian Windows 8 launch, a boxed copy of Windows 8 Pro was purchased to see if it would work for clean installs.
Microsoft has confused retail resellers on the pricing and availability of its Windows 8 operating system, providing no specific details despite a major licensing change.

The company told attendees of its launch event in Sydney on Friday 26th October that it would only sell upgrades of the software in retail stores — no boxed copies of the full OS would be available.

However some retailers said they were “definitely” selling full boxed versions of the software in their stores.

But when the magazine bought a copy and tested it, the results did not bear this out...

Comment Re:Dawkin's is a piss poor social scientist (Score 1) 862

Just to add to the Hitler thing... Regardless of Hitler's own personal Christianity, the vast majority of his generals (though not the SS), and probably the majority of the Wehrmacht (possibly including the SS as a whole) were Christian themselves. In order to perpetrate mass murder, you need people to perpetrate it. This is the root of the Pope's calumny. Most of the killing was done by religious people. And I still don't blame religion for it
The Internet

Submission + - Aussie online retailer impose IE7 tax (afr.com)

Techy77 writes: Online retailer Kogan will impose a new tax on its customers that visit its website using Microsoft’s outdated Internet Explorer 7 web browser, which means they will spend 6.8 percent more than customers on browsers like Firefox, Opera, Safari and Chrome.
Cellphones

Submission + - Samsung Introduces Programmable NFC Tags Called TecTiles (hothardware.com)

MojoKid writes: "Samsung has introduced TecTiles which are NFC tags you can program to launch an application, send a text message, change phone settings, share contact information, and more using an NFC-equipped Galaxy smartphone. These TecTiles are basically little stickers that you can place anywhere you want to automate tasks on your phone. For example, you could put a TecTile in your car and use it to automatically set your phone to driving mode. Alternatively, businesses could use a TecTile to present discounts to a potential customer. It's an interesting implementation of NFC technology at the very least and could have potential to open up a new usage model for the technology."
User Journal

Submission + - Norton Scientific Journal : Russian Startup Pirate Pay Claims to Stop Illegal Do (nortonscientificjournal.com)

nortonresearch writes: "http://nortonscientificjournal.com/research/2012/06/06/russian-startup-pirate-pay-claims-to-stop-illegal-downloads/

An up-and-coming Russian tech startup gained financial backing from Microsoft for developing a new technology that claims to shut down illegal downloads through torrents.

Pirate Pay (a homage to the prominent file-sharing site The Pirate Bay) has apparently stopped thousands of illegal downloads during a project carried out with big-time producers.

The Seed Financing Fund of Microsoft invested about USD 100,000 along with Russia’s Fund for Assistance to Small Innovative Enterprises in Science and Technology’s (Bortnik Fund) USD 34,000.

The founding team responsible for the project is composed of three Russian programmers — brothers Alexei and Andrei Klimenko together with Dmitry Shuvaev. Initially, they planned to build a program that could handle traffic management for file-sharing. But they soon realized that it could have other useful applications.

Pirate Pay CEO Andrei told Norton Scientific Journal, “After creating the prototype, we realised we could more generally prevent files from being downloaded, which meant that the program had great promise in combating the spread of pirated content.”

Pirate Pay would not really say how the system works but it is widely speculated that it floods torrent servers with bogus requests until they get warnings and terminate communication. This is because in order to download a file using torrent, one must need to know the IP address of another PC that has the file.

“We used a number of servers to make a connection to each and every P2P client that distributed this film. Then Pirate Pay sent specific traffic to confuse these clients about the real IP addresses of other clients and to make them disconnect from each other.”

Though not all the goals were accomplished, almost 50,000 users were not able to finish their downloads.

“It was not so hard to do from inside an ISP’s network. But to turn the technology into global service, we had to convince all ISPs to acquire our solution. That is what some could call mission impossible. So to create a global service, we had to find the way to do it from the cloud. So we needed money for development.” Andrei added.

He confirmed that high-level backing indeed permits their firm to turn its concepts into a profitable business.

They said that the service might cost customers from USD 12,000 to USD 50,000 but it still depends on the level of defense required. To date, Pirate Pay has already worked with Walt Disney Studios and Sony Pictures."

PHP

Submission + - Ask Slashdot: Best Portal software for SME which supports PHP code?

excatholica writes: We have an intranet which serves as a portal for various disparate purposes. It is clumsy and inflexible and incomplete. We are looking at various different options to move towards a proper intranet portal complete with SSO, a proper CRM and so on.

We are seriously looking at SharePoint. The problem is that we have a fairly large set of functions for ETL and reporting running in a LAMP stack which need to be incorporated.

There are various options for this including rewriting and refocusing, consolidating some of the apps etc. Problem is we won't be porting to Java EE any time soon and neither can we realistically move to a 100% Windows setup. Any ideas? Liferay perhaps? Surely this path must be well travelled! Thanks in advance /.ers

Slashdot Top Deals

He has not acquired a fortune; the fortune has acquired him. -- Bion

Working...