Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
×

Comment Re:His viewpoint is staggeringly ignorant (Score 1) 618

I think adblockers are great - for the end user to own and maintain. I've been running filtering proxies of one type or another since the last millennium. (And nothing will teach you the nuances of regex like the challenge of stripping out unwanted HTML tags.) It's for me to decide what I want my browser to display.

But just as it's wrong for my ISP to inject their own ads, it's also not the place of my ISP to censor them out of my data stream. That's my decision, not theirs.

Comment Re:How can this be? (Score 1) 190

Good point. I would not assume that flight information is from the nav and control systems. But it could be, in which case they could use one-way data isolation devices to eliminate the possibility of anything on the entertainment system negatively impacting navigation controls. That would technically be a "tie", but not one that could be exploited.

Yes, they *could* have used some kind of special 'data diode' isolation device, but then the researcher probably wouldn't have been able to jump networks in the lab, or, as stated in TFA, "He told WIRED that he did access in-flight networks about 15 times during various flights but had not done anything beyond explore the networks and observe data traffic crossing them".

Car networks (CAN bus) have a similar weakness in that the infotainment systems have previously been breached, allowing attackers access to cross over to security systems and unlocking the doors.

Comment What if.... (Score 3, Insightful) 190

What if the protection on planes is so bad that a passenger can use the inflight entertainment system to gain virtual access to the controls of the plane?

Suppose you are a security researcher and find this out. What do you do? Tell boeing! They... do nothing. Tell the airline! They.... do nothing.

It all starts with a belief issue. You hack into the entertainment system, compromise the firewall and see plane-control messages flying around on the network you now have gained access to. This is enough for a sufficiently technical person to be convinced of having gotten too far for comfort. At that point you know you are only one step away from taking control of the airplane.

Tell anybody less technical about it and they will not be convinced that you'd be able to move the plane. For example, today with this news today someone already voiced: "he might only THINK he moved the plane" (... while in fact the pilots initiated that maneuver).

So... to prove to the world that there indeed is a dangerous situation, you need to actually make the plane move.

And this is where everybody gets their panties in a knot. Suddenly the guy who reports that the planes are not secure enough is the bad guy and needs to be thrown in jail.

Examples of people reporting security problems and being ignored include: On a saturday night two men walking their dogs notice that the bank has left a window open. A person can just climb into.. the bank! So monday morning they walk into the bank, tell them about it, bank says thank you and... nothing happens. Next weekend, window is again left open. So they tell the bank again. And again. After a few times, to prove the point, they decide to climb in, and photograph what access they have once inside the bank. They got into a lot of trouble for that. But since then, the window has been closed.

Personally I have reported security problems in computers without going that extra mile of "making the plane move". In one instance I've reported such a misconfiguration to over 100 system administrators. Two hours later, saturday afternoon, the first response: "Thanks, fixed". Come monday morning, one response: "we know, not a security issue, get lost.". And all others were "no response". A year later more than 50% of the computers where I reported the configuration error were still vulnerable.

With laws being written in such a way that the "white hats" (*) can be thrown in jail, we create an environment where the white hats are either ignored or thrown in jail. Before you know it, the "white hats" are too afraid to report anything and stop reporting real problems. In that situation, you only find out the problems when a bad guy ends up crashing a plane.

Boeing: invite the guy over to show you the problem. Once that hole has been closed, invite him over, pay his hotel an meals for a week while he hacks at a "fixed" plane on the ground at your facilities. Credit him for making aviation safer.

(Do this, before someone makes it stick that: "Boeing created this system with such bad security that it put passengers at risk.").

(*) the researchers that report the problems they find without causing real harm,

Comment Re:How can this be? (Score 2) 190

There's no way that entertainment/wifi/anything-accessible-to-a-passenger could in anyway be connected to those critical systems...is there?

There should be no tie between the control and entertainment networks. I would be surprised if there aren't regulations that forbid it. My guess is this simulated system was not like the real ones. It certainly isn't clear what really was done.

If there is no tie between the entertainment and nav systems, then it becomes difficult to explain the seatback display of the current flight information. At some point the data has to move from one system to the other. That takes a lot more than "no tie".

Comment Re:Sociopath (Score 1) 170

You'd find that people who aren't training to be pros, but work out that much, are probably more common than you think.

yep - count me in. i'm currently up to about the same level of exercise as you - about 2 hours a day: tennis or street-skating. tennis is for my eyes - and the social interaction. street-skating is because i find the explosive (sprinting) nature of tennis is causing huge knots in my arm and leg muscles. without this, i am... yeah, not a nice person either :)

Comment Re: -dafuq, Slashdot? (Score 1) 249

Albedo? Do you even know what that word means? You do realize the ice is melting, exposing more dark ocean and earth and accelerating the retention of heat?

And Venus is your example of a self correcting mechanism? A planet with an surface temperature of nearly 900ÂF thanks to its CO2 atmosphere?

Please tell me you're actually mocking idiots that make those kinds of statements and l just missed the joke. ....

Comment Re: -dafuq, Slashdot? (Score 1) 249

Congratulations. That is the stupidest thing I've read on the internet today.

The cost of cancer treatment is high; the cost of doing nothing is small. That's the logic you're using. If we attack the problem now, aggressively, we might preserve many of the species that will be adversely affected by rapid shifts in environmental pressures -- ourselves included.

Or are you of the persuasion that believes a magic man in the sky is going to swoop down and save us all?

Comment Strange swarm behavior (Score 2) 220

We've seen strange swarm behavior here in Southern California the past two years. Anecdotes follow:

Last year, we had a swarm that probably lost its Queen (or didn't have one to begin with). They maintained a big ball in the tree for nearly four months, gradually all dying off. They made no honeycomb, just a few weird strands of propolis. In the past, when swarms failed to form a new hive, they didn't continue to go and harvest pollen and function like a hive, but all died off much more rapidly.

This year, we had a swarm ball up in a tree mid-afternoon. They hadn't found a hive by the next morning. By the next evening, they were all falling to the ground and writhing as if poisoned or something. By the second day, there were just heaps of dead bees all around the garden.

I don't claim to be any expert (although my Dad kept several hives when I was a kid). Still, I haven't seen this before. I don't know the cause of either phenomenon.

Comment Tennis and Computing (Score 2, Interesting) 170

two years ago i took up tennis at the recommendation of a friend. before that i'd done tai ji, full-contact karate (shin kyu-kshin), long-distance skating (86 miles athens-to-atlanta 1999, 65 miles new york park 1999, 26 miles rotterdam 2006) and yoga (ashtanga and T.M Asanas). it's a big list of different physical activities, which have the following things in common:

* complex coordinated movement
* requiring or recommending very deep breathing (skating especially)
* very long and regular practice

the reason why i specifically love tennis is that in addition to these things it is necessary to not only be extremely physically fit but also, if you would like to win, you require strategy and planning both on and off the court. tennis is particularly harsh on the body in that it is a series of very short explosive sprints, standing still, *then* hitting the ball, and then doing it all over again.

also the types of movement required are *unbelievably* complex! serving involves *six* degrees of freedom of movement (x-y-z, rotation in x-y-z) in order to impart the maximum amount of inspired deviousness into a small yellow round object.

to fully understand why it was that, aged 44, i started this sport and now practice over an hour a day, you have to understand that prior to that i was sitting 12 hours a day in front of a computer screen: average distance approx 1 metre. for the prior 4 years that was a 24in imac, so the panorama i *initially* thought was great.... turned out to have caused extreme alterations in my eyes.

just over two years ago i discovered that my eyes had gone "prism". this is a new development: i've always had -0.75 astigmatism, but prism basically means that i can focus easily on an object that's 1 metre away, but if i look at something 3 metres or greater away i see *DOUBLE*. in the dark, i can't bring the two together.

the implications of that are that not only has there been physical damage caused by long-term computer usage but that there has also been *NEURAL* damage caused by long-term computer usage.

the bottom line of this story is, in this context, that this football player is being extremely sensible. if a few neurons get knocked out of place by a concussion, so damn what: his pursuit of mathematics will, by virtue of it being so incredibly challenging, allow him to grow new pathways and literally grow new neurons. the reason why his peers get brain damage is because they *don't* have anything other than football to challenge them.

each of his pursuits therefore supports the others. the physical exertion keeps his body - and his heart - fit. that in turn allows him more oxygen with which to feed his brain and thus sustain the pursuit of mathematics. the increased mental alertness allows him to play with tactics and strategy that the average player would not be able to consider. his specialty in mathematics would allow him to apply physics (moments of inertia) in a *really* practical way that would keep both him and the people he smacks down safer than would otherwise be done by someone without his knowledge.

but the best part of all this is that if he has a successful long-term career, i predict that he will end up inspiring thousands of young football players to pay a bit closer attention to their other studies, and that coaches will have an example - a specific person - that they can quote as to why, when they go recruiting, they are looking for someone who has not only the physique but also the high academic aptitude as well. ... wouldn't it be great to have an entire team of football players who not only kick ass (literally) but who have degrees and even PhDs? that would change how people think of football, forever.

Comment Re: 23 down, 77 to go (Score 3, Informative) 866

I'm fairly certain humanity would find plenty of reasons to wage war if religions were not around to blame it on.

Religions were created as the first rudimentary forms of government or control over other people, and are still remarkably effective at that task. They only require an ongoing group of leaders to ensure obligations are continually felt by the members, as it's difficult to create a new religion quickly with a large enough number of committed adherents to wage an effective war.

The entire process is well understood and practiced worldwide.

Submission + - Smart Grid Meter Homegrown Security Protocol Crushed By Researchers

plover writes: According to this article in ThreatPost,

Two researchers, Phillip Jovanovic of the University of Passau in Germany and Samuel Neves of the University of Coimbra in Portugal, published a paper exposing encryption weaknesses in the protocol.

The paper, “Dumb Crypto in Smart Grids: Practical Cryptanalysis of the Open Smart Grid Protocol” explains how the authenticated encryption scheme used in the OSGP is open to numerous attacks—the paper posits a handful—that can be pulled off with minimal computational effort. Specifically under fire is a homegrown message authentication code called OMA Digest.

Comment a data collection device in antarctica (Score 5, Interesting) 403

andrew trigdell told me an amazing story back in 1999 about how he helped install Linux 0.99 on a solar-powered data collection computer in antarctica. Linux 0.99 was known to be highly stable, hence why it was chosen. it has a 56k modem which is enough to get the data back, and to check (very slowly) that it's still operational. so i think anything that's designed for long-term with those kinds of harsh remote and inaccessible conditions in mind, powered off of sustainable independent power, would be a good candidate for a device that would still be functioning even decades later.

Comment Re:Awesome (Score 1) 39

That's really great news for Liberia. Thanks are due to all of the brave Liberians who worked tirelessly to control and treat this outbreak.

Yeah...but I"m curious...

Why did Roger Daltrey and Pete Townshend break this news......?

Because Keith Moon is dead.

Slashdot Top Deals

Old programmers never die, they just hit account block limit.

Working...