Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×

Comment Re:Unfortunately? (Score 1) 82

So the ONLY statement anyone picking "GPLv2 only" is making, is that they don't want their code mixed with GPLv3 which honestly... is pretty silly.

If "GPLv2 only" is silly, then you might want to alert all the Linux kernel developers. After all, the code in the Linux kernel is GPLv2, not GPLv2+.....

Comment OPIE may be what you want. (Score 2) 113

It's not a two factor authentication, it's actually a means of generating one time passwords. In a nutshell, you can have a local device calculate the password based upon a challenge sent from the system you wish to log onto, or you can preprint a list of passwords that you can use to log onto the system.
See http://en.wikipedia.org/wiki/O... for a general description of the method. You ought to be able to find out more using that page as a starting point.

Comment Re:Missing Key Information (Score 4, Interesting) 144

Oh good god...

I was a LM employee a few years back. Brought in on a project that was failing. And the main issue with the failure was their process.
For instance, LM was using Common Criteria and they were trying to get the system to EAL4. And frankly, getting there is quite doable. Unfortunately, management and the customers for the project didn't bother to actually understand anything about requirements.

For instance, in Common Criteria, your need to tailor the documents. An example would be this template being tailored to the system requirement:
FPT_FLS.1.1 The TSF shall preserve a secure state when the following types of
failures occur: [assignment: list of types of failures in the TSF].

The above template is obviously intended to be tailored to include a list of possible or predictable failures upon which the system will still remain secure. But this is how LM tailored that little beauty:
FPT_FLS.1.1 The TSF shall preserve a secure state upon a partial system failure.

Notice how the tailoring totally removed anything concrete about the requirement? What kind of partial failure? How do you test it? When is it violated? etc, etc, etc, ad nasium.

And that kind of bullshit "tailoring" was done EVERYWHERE. There would be multi-hour meetings just change, tailor, and interpret specifications tailored that way. And any suggestion by anyone working in the trenches stating that the requirements were badly done and needed to be redone properly in order to actually get a functional system was met by "We can't do that, it would be too costly."

If the above paradigm was used on the Social Security project, I can definitely see why progress has been snail slow and over budget. They're most likely still attempting to get their specifications correct.

Comment Re:110 or 240v (Score 3, Informative) 260

The 240V 60Hz is so that it can handle both North American and UK voltage levels. If you look at the technical specifications document, you'll see that there are 2 different grounding configurations that the contestants may specify. In both configurations the inverter output is fed into an isolation transformer. One specification has the input of the isolation transformer center tapped and grounded which makes the AC outputs from the inverter swing +/- 120V from ground like you would expect in the USA. The other configuration doesn't have a center tapped transformer, but one leg of the input is grounded making one of the AC outputs swing +/- 240 V in referenced to ground and the other output is tied to ground. I suspect the 60Hz specification is due to the way transformers work. A transformer designed to operate at 50Hz using minimal materials will operate fine at 60Hz. However a transformer designed to operate at 60Hz using minimal materials will saturate magnetically at 50Hz causing it to overheat and eventually fail.

Comment Re:uh huh (Score 1) 89

And you've still avoided naming any metrics....

Number of lines of code? As mentioned earlier, one can easily inflate LOC with trash.
Also how do you evaluate a programmer who actually reduces the lines of code in a program? By the LOC metric, said programmer is counter productive. Then again you get the beautiful quote by Ken Thompson... "One of my most productive days was throwing away 1000 lines of code."

Code quality? Once again, how do you judge it?

Comment Subpoena vs Warrent (Score 2) 749

The real issue at hand is the difference between a warrent and a subpoena.
The legal requirements to obtain a warrent are rather trivial and obtaining a warrent is rather easy. But a warrent doesn't extend past the boundaries on the United States. A subpoena on the other hand has far stricter oversight and requirements to obtain. But a subpoena requires the one served to provide the information requested regardless of where in the world that information resides.

What's happening is the government is attempting to get the best of both worlds. The trivial requirements of obtaining a warrent, combined with the expanse of a subpoena. And that frankly is wrong and needs to be stopped.

Comment Re:Now I'm confused ... (Score 3, Insightful) 380

Unfortunately, it needs to be anhydrous ammonia.
Looking at the paper, what they're doing is

1. Convert sodium amide into metallic sodium, hydrogen, and nitrogen.
2. Convert ammonia and metallic sodium into sodium amide and hydrogen.

They can easily balance those two reactions.
However, if there's any water in the system, there will be a 3rd reaction going on as well.
3. Convert water and metallic sodium into sodium hydroxide and hydrogen.
That 3rd reaction would effectively consume the sodium prevent it from making more sodium amide.

Given how nasty anhydrous ammonia is, I definitely know I wouldn't want to be anywhere near an accident involving it.

Comment Re:Except, of course, they have to prove you can (Score 1) 560

As all the other posters have already mentioned, your plan won't work. But way back when anon.penet.fi was finally forced to reveal through the legal system, the real email address of a user, I did a bit of a mental exercise.

How could someone create a pseudonymous remailer that would be extremely hard if not impossible to break through the legal system?

The scheme I thought up was as follows.
      1. Maintain an encrypted database of email addresses and pseudonyms.
      2. Have the key to the above mentioned database stored only in RAM and never written to any persistent storage.

The above scheme would work, but power failures and reboots would effectively destroy the database so it's not a complete solution. But to work around the power issues, add the following.
      3. A UPS to minimize power issues (not really required, but will reduce the down time)
      4. Have the key split into multiple parts and have those parts sent to multiple trusted parties in multiple legal jurisdictions. There's plenty of secret splitting techniques out there to do this. And if your escrow parties happen to be in the USA, Finland, Italy, Switzerland, etc., it would be rather difficult to have enough of them divulge the key portion that they've been entrusted with. And of course, have those parties instructed to destroy their key portion if they ever discover that legal proceedings have been engaged against you. And of course, have your lawyer instructed to inform those parties as well.

So in the above situation if you lose power, or need to reboot, the system will be in an unusable state, but will contact the escrow parties to retrieve the key parts and reconstruct the encryption key. Once this happens, it resumes normal operation. But most other governmental attacks would have a very slight chance of success.

Of course, other refinements could be added such as a periodic "ping" to the escrows informing them that things are still OK. If a sufficiently long time elapses without such a keep alive ping being received, the escrow would delete the key portion entrusted to it.

To break such a system would be extremely difficult.

Slashdot Top Deals

The Tao is like a glob pattern: used but never used up. It is like the extern void: filled with infinite possibilities.

Working...