Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Comment Re:Boeing employee here (Score 1) 82

There's a difference between them being generated and sent in an email (which is not exceptionally dangerous because it should be temporal (that is, you force a change when they log in and only allow it to be used within a brief window of time) and sending you an email with a stored password on request. Don't mistake the two. Again, the implication that they're storing your password with no more than a basic reversible cipher is very troubling.

Comment Re:Boeing employee here (Score 5, Interesting) 82

Nothing annoys me more than plain text passwords in emails. Double bonus points if it's a password for something sensitive like my financial information (ex: 401(k), which are among the worst offenders in the bad security department...it's not like they have the largest sum of money in my name, after all).

The other disconcerting thing (probably the most frightening) is that they sent you your password in plain text. This means that your password is, at most, protected with a reversible cipher and is likely stored with no protection at all. That means if someone broke in (which doesn't even mean a threat from outside is necessary, and there are probably tens, if not hundreds, of people with accounts and/or passwords to get to the database) they could get your password and potentially every one you ever used. Then the real social engineering begins, when they call your bank with all your legitimate information and every likely password for your account in hand... Scary.

Submission + - Security hole found in Obamacare website (cnn.com)

RoccamOccam writes: The Obamacare website has more than annoying bugs. A cybersecurity expert found a way to access users' accounts.

Until the Department of Health fixed the security hole last week, anyone could easily reset a user's Healthcare.gov password without their knowledge and potentially hijack the account.

The glitch was discovered last week by Ben Simo, a software tester in Arizona. Simo found that gaining access to people's accounts was frighteningly simple.

Comment Would be important... (Score 1) 1

...if the population of Japan, particularly in the relatively-rural region near the Fukushima reactor, were not well past reproductive age. They do realize they are in the second-oldest (demographically) country in the world, right?

If the workers don't have protection already, something is very wrong.

Submission + - Avoiding genetic damage with anti-radiation underwear (networkworld.com) 1

Mark Gibbs writes: If you're unlucky enough to live somewhere near Fukushima and particularly if you're even more unlucky enough to be one of the workers cleaning up the mess then protecting your genes would seem to be a really good idea and Yamamoto Corporation of Osaka, Japan, has the answer: Radiation-proof underwear.

Comment Re:It was already a dangerous site to visit ... (Score 1) 189

This sounds like a bigger trainwreck than many mixed-HTML PHP sites (which is the dirtiest thing about the language). A well-written PHP-based site will do what you say, but it will have no echo statements or anything else along these lines. Instead, it will use templates with placeholders that it fills with data. When I've worked in PHP, I've done this since the early 2000s. It's simply the only way to keep it clean, readable, and delineate logic from presentation. An added bonus is that you can usually teach a web designer to work with/around simple placeholders much easier than teaching them not to screw up your code.

Comment Re:It was already a dangerous site to visit ... (Score 1) 189

Herein lies the problem. There really isn't another decent cross-platform scripting language for web development. Even the shift toward JavaScript on both sides is full of epic failure (after all, we're talking about JavaScript here, which is only marginally better than the other client-side messes it replaced). Wikipedia uses PHP (albeit with front-end caching), so it clearly can be done right. The fundamental problem with PHP is that it has roughly 15 years of crufty functions with nonexistent naming conventions and senselessly-random parameter orders (contrast this with Python and Perl, two other wildly-popular scripting languages).

Also, don't say "Java", which is a mess that requires outrageously heavy backend support to make it useful for web development. Scripting is the best solution for the large percentage of sites that don't have huge teams and budgets. It's also the best choice for sites with rapidly-changing requirements.

Comment This is news? (Score 1) 104

16 years ago I worked on/developed industrial control systems and the fact this industry hasn't moved anywhere on the security front is not surprising. At the time development was still 1970s-80s style, save the punch cards. Most of the software developers had never learned structured programming and would still argue against it a solid decade after their mainstream ilk gave up the fight. Their code style was pure 70s at best and pure chaos at worst when written by the EEs. The newest code was all written in a language that I thought was already in the dustbin of history 5 years before I got there. Network security was completely foreign to everyone there.

The equipment was extraordinarily-buggy on top of our highly-questionable software. I remember numerous long nights isolating and writing workarounds for bugs or code that defended them from the user. These black boxes were all selected by either EEs for electrical characteristics, MEs for physical mounting/environmental characteristics, or some combination of the two. Their prices were high and therefore they gained a strange aura among non-programmers for being infallable objects with exceptional engineering.

The funny thing is the last time I heard from a contact there my software was still in use cooking up parts and the company was still selling injectors using the same crappy DOS-based interfaces we had back then. Mind-boggling. Today I can hardly fathom software that remains unchanged for even a couple years due to the pace of change on the internet.

Comment Re:recipie for disaster (Score 2) 391

+1 on Blizzaks

I loved my Blizzaks when I lived in the snow country. I ran normal tires for years with good results (after all, where I lived you only had 5-10 days with snow on the ground to worry about in a normal year) until the year I did a project in Wyoming and decided it was a good idea to get snow tires. These tires are unbelievable, even on straight ice. They looked really weird, but their performance made me a believer.

Comment Re:Doesn't matter (Score 1) 417

You're missing the point and your first sentence is a blatant troll.

They're not writing software for the Mac or iPhone, they're using it as a tool to write platform-agnostic code. That's why I found the results so interesting: When given the option, they went for the best tool for the job, not for the cheapest tool in the box.

The second most popular operating system there among the software engineers is Linux on one of the other brands of laptop. This doesn't surprise me at all.

Slashdot Top Deals

"Everything should be made as simple as possible, but not simpler." -- Albert Einstein

Working...