Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Comment Re:Since when is every search engine Google? (Score 4, Informative) 156

zmodem was several generations newer.
kermit -> xmodem -> ymodem -> zmodem

I still use uucp, by the way. For communicating with faraway sites where the connection depends on a shaky cell phone connection that may or may not be up, it's a pretty good way of moving e-mail and logs.

Comment Re:Good. (Score 3, Insightful) 156

Now the FBI and the Sheriff would be able to set up stings more efficiently.

FBI and the Sheriff? You have no real insight in how law enforcement works here in the US of A, do you?

There are dozens(!) of different police forces, and they seldom cooperate on anything, but try to not step on each others' toes. A sheriff is county police and would not be involved in any international or interstate crime sting. Speeding tickets, serving divorce notices, arresting the busker in front of the strip mall, signing reports of items stolen, sit in cars at local road work - that's the sheriff's department. Investigative work to catch internet facilitated high crime is not going to involve the sheriff.

Crime

New 'Google' For the Dark Web Makes Buying Dope and Guns Easy 156

First time accepted submitter turkeydance (1266624) writes "The dark web just got a little less dark with the launch of a new search engine that lets you easily find illicit drugs and other contraband online. Grams, which launched last week and is patterned after Google, is accessible only through the Tor anonymizing browser (the address for Grams is: grams7enufi7jmdl.onion) but fills a niche for anyone seeking quick access to sites selling drugs, guns, stolen credit card numbers, counterfeit cash and fake IDs — sites that previously only could be found by users who knew the exact URL for the site."

Comment Re:Metaphor (Score 1) 235

While you are technically correct, the reality is that the most serious security vulnerabilities are almost all directly related to buffer overruns (on read or write), allowing an attacker to read or write arbitrary memory. Everything else is a second-class citizen by comparison;

In my fairly long experience, there are ten vulnerabilities introduced at the design stage for every vulnerability caused by bad coding. Buffer overflows might be one of the more common coding errors, but certainly not the main cause of vulnerabilities.

Comment Re:When did slashdot become a blog for Bennett? (Score 1) 235

Okay, I'm obviously missing some important details not being a security expert. Clear a couple things up for me.
1. Do security researchers spend their efforts actively searching for one particular bug using one particular method, or do they try a lot of different things and expect to find a lot of different bugs of varying levels of importance?
2. Do companies looking at their own code for bugs only concern themselves with bugs that would be worth selling on the black market, or is every bug a concern for them?
3. Bit of an opinion question, how much would you consider spending to find a bug to sell for $100k considering the potential failure of the endeavor?
4. Do you think bug bounties are the primary motivation for white hats to research bugs, and if not what effect do they have?

I don't think Mr. Haselton is qualified to answer these.

1: A little of both. I can only speak for myself, but I tend to look at a particular piece of hardware or software, and poke it until I find something interesting. Now interesting doesn't have to be a vulnerability, but it engages the brain. Could there be an exploit in here? And if not, could there be an exploit in other products that use a fairly similar design for something?
I may start looking at product A, and find X interesting, but end up finding a defect Y in product B.

2: Both. You sell not only a product, but a perception that you care about your customers. Besides, most companies have people in decision who wouldn't be able to make an educated decision on what type it was, and underlings whose opinion is tainted because they have a real need to cover their own ass. And the companies certainly won't take the word of a hacker as to what the impact is, so they'll usually err on the side of caution, i.e. treat it seriously.
Note that treating it seriously might mean it will take quite a long time to fix, because taking code seriously also means extensive tests that fixes don't break anything else. A company that has a very fast turnover for security fixes is one that I wouldn't trust much - it's a prime candidate for looking for more problems.

3: You start with a premise that the hunt is to get a reward. I believe that's almost always a false premise.

4: No, I think the primary motivation is curiosity. Unless that;s your primary driver, you will likely not be good at it.
A bounty might make a hacker go to the company after they've discovered the bug, instead of just sitting on it.
Which I think is what mostly happens. You know about a security flaw, but don't want to go to the company given the high risk of being sued in best shoot the messenger style. And you don't want to turn blackhat either, neither for criminals nor governments. But, I repeat myself. And if you're not a kid looking for notoriety, chances are you won't tell anyone.
I am quite convinced there are thousands of unreported vulnerabilities. Bounties might help with that.

Bug

Bug Bounties Don't Help If Bugs Never Run Out 235

Bennett Haselton writes: "I was an early advocate of companies offering cash prizes to researchers who found security holes in their products, so that the vulnerabilities can be fixed before the bad guys exploited them. I still believe that prize programs can make a product safer under certain conditions. But I had naively overlooked that under an alternate set of assumptions, you might find that not only do cash prizes not make the product any safer, but that nothing makes the product any safer — you might as well not bother fixing certain security holes at all, whether they were found through a prize program or not." Read on for the rest of Bennett's thoughts.

Comment Re:Better leave now (Score 1) 239

I stand corrected.
However, I assumed it won't be feasible to use a drive type where you bring all your fuel with you from get-go - several years of constant 1 g acceleration would mean a lot of fuel and a correspondingly damn huge engine for the initial part.

I was thinking a Bussard drive, where the energy of the particles you rely on for fuel drag you down more the faster you go, making it harder and harder to increase the speed, until you need a near infinite amount of energy to overcome the near infinite amount of mass/energy working against you.
(Unless you can pull a Poul Anderson, that is.)

Comment Re:Better leave now (Score 3, Informative) 239

Sorry, but time is not an absolute clock that ticks the same everywhere. Time is a local phenomenon, and only a local phenomenon. We all live in separate time frames.

If you accelerate to 99% of the speed of light, the Lorenz factor is a little over 7, which means that for an outside observer counting one year on the clock, you will only have experienced 51 days.
As your speed creeps closer and closer to c, the time dilation increases. If you could reach 99.999% of c, the Lorenz factor would be 223. For an outside observer watching you travel 100 light years from A to B, 100 years would pass. But for you, less than 5.5 months would have passed.

If you could maintain a 1g acceleration indefinitely, you could travel to another galaxy and back within a human lifetime. It's not feasible, though, as you require more and more energy to accelerate the faster you go, and as you approach c, you approach needing an infinite amount of energy for an infinitesimally small boost in speed.

Comment Re:The vessel matters (Score 1) 588

So the average lion prefers to eat people with weak immune systems? I'm not getting this.

You cannot see how a virus or bacteria can be considered a predator? Or if you really meant to ask about lions, of course they pick off the weak. It's less work. This leaves the herd's average health better after the predation.

Now, suppose we stopped inoculations, and people started dying of these preventable diseases in large numbers. Would this make the species healthier, or just resistant against threats we've already got handled?

Both. Healthier individuals would have a greater chance of survival, and thus a greater chance of passing on their genes. People born with congenital heart failure, asthma or a variety of other conditions would have a higher risk of dying, and less chance of passing on their genes.

There's a by-country correlation between longevity before and after the Spanish Flu. In countries that got hit, longevity increased. Weaker individuals got culled more than healthier ones, and the net result after a generation is a healthier population.
Now, we're seeing the opposite. The number of people with defects (like, but in no way limited to, asthma) is going up. We put great effort into keeping the weak alive and able to reproduce. With a very predictable result: the defects flourish when there's no evolutionary disadvantage to having them.

If you want me to go along with killing large numbers of children that we could save, you're going to have to have something more specific than "increasing the average health of the herd".

How about the overall human health being at a higher level, so when a new marburg/ebola type virus catch us out of the blue, we have a higher chance of survival?

How about when the temperature and humidity raises across the globe, and many of us are too weak to survive it?

Or any number of unforeseen things that may happen, in which a healthier population has less risk of extinction?

Compassion for the weak and exceptionally strong parental instincts might have been a good survival trait in the past, given our long reproductive cycle. But that's no longer a concern. We're not just a few packs on the African plains struggling to survive despite 9 month pregnancies and 12+ years before becoming reproductive. Every life counted back then.
We're now billions of people, and propping up the weak is now detrimental to us as a species. A few tens of thousand deaths a year is now a negligible price to pay for humanity as a whole, to reduce the creep towards the average human being less healthy.

Comment Re:Survival of the Species (Score 1) 307

How much interbreeding was there between humans in Europe and the southern parts of Africa for the ~1000 years after the Roman empire? How much interbreeding was there with the North American tribes before 1492? Nobody regards first nations or africans as not being part of the human race.

In fact, the US government, when it on its forms asks about "race", it does exactly that.

If you mean same species, sure we are. Just like a Great Dane is the same species as a Yorkshire Terrier.

As for how rapidly change can occur, that depends on the pressure. Flowers and animals have been cultivated with rather rapid divergence.
There's no reason why the sieve of "is this person fit to live in low-G" is any less effective than "is this dog fit to be my hunting companion".

It won't take long before we're at the stage of "I have nothing against spacemen, but I would not want my sister to marry one". And at that point, we have diverged enough that they're not "us" anymore.

Slashdot Top Deals

"May your future be limited only by your dreams." -- Christa McAuliffe

Working...