Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
×

Comment Re: More great insightful summaries from /. - not! (Score 1) 76

I've used the site longer and reserve the right to use Doctor Who references where I'm suspicious of technical details, especially as relate to timing vulnerabilities. This is allowed, as per The Hacker's Dictionary. Bonus points for finding the Doctor Who references included.

Comment Re: Cursory reading (Score 1) 76

That was pretty much my interpretation as well. Which would be great for ad-hoc encrypted tunnels - the source and destination can have keys that are valid only until the tunnel's authentication expires (typically hourly) and where the encryption is based on the identity the other side is known by. Ad-hoc tunnels need to generate keys quickly and efficiently, but also don't need to be super-secure. In fact, they can't be.

If RIBE isn't useful in ad-hoc, then you'd end up having to ask when it would be useful.

Anything that depends on a third party, including PGP/GPG with keyservers, is vulnerable to some form of compromise, SSL/TLS certificates all have a third party signer and Kerberos depends on all kinds of behind-the-scenes work being secure. However, although they're imperfect, they're considered adequate for what they do. Well, except for SSL, perhaps.

RIBE presumably therefore also has a niche where it's good. Rapid key turnover is what's wanted for conversation-based protocols with timeouts. That makes RIBE sound promissing for IPSec ad-hoc and SSL, as it makes store and crunch by attackers less likely to work. But is that the right niche?

Comment Sigh... (Score 1) 795

Countless academic disciplines have been wrecked by professors' urges to look 'more scientific' by, like a cargo cult, adopting the externals of Baconian science (math, impenetrable jargon, peer-reviewed journals)...

How dare those academics use math, specialized jargon, and peer-review! Witchcraft, I tell thee, witchcraft!! (Quick hint for whatever PR firm submitted this: science is extremely complex and extremely specialized these days. Sorry if your marketing degree didn't prepare you for anything better than spreading FUD.)

This is how you get people asserting that 'science' commands this or that public policy decision, even though with very few exceptions, almost none of the policy options we as a polity have have been tested through experiment (or can be).

Yah, we only have one earth at the moment, so it's sort of hard to directly test the effects of (1) implementing or (2) NOT implementing a carbon excise tax on the next 100 years of climate change. Science can't do that. Of course, neither can lobbyists or SIG's or true believers or anyone else.

What science can do (for a sincere policymaker) is provide the firmest foundation of knowledge to work with. And science quite confidently tells us a lot of things we don't want to hear (like "all this carbon is going to make the environment go wack, do something about it" or "your ass is getting fat on all that sugar and processed foods", or "life arose thru such-and-such set of processes and not ex post nihlo, sorry if that challenges your theology LOL").

Submission + - New revokable identity-based encryption scheme proposed (plosone.org)

jd writes: Identity-based public key encryption works on the idea of using something well-known (like an e-mail address) as the public key and having a private key generator do some wibbly-wobbly timey-wimey stuff to generate a secure private key out if it. A private key I can understand, secure is another matter.

In fact, the paper notes that security has been a big hastle in IBE-type encryption, as has revocation of keys. The authors claim, however, that they have accomplished both. Which implies the public key can't be an arbitrary string like an e-mail, since presumably you would still want messages going to said e-mail address, otherwise why bother revoking when you could just change address?

Anyways, this is not the only cool new crypto concept in town, but it is certainly one of the most intriguing as it would be a very simple platform for building mostly-transparent encryption into typical consumer apps. If it works as advertised.

I present it to Slashdot readers, to engender discussion on the method, RIBE in general and whether (in light of what's known) default strong encryption for everything is something users should just get whether they like it or not.

Comment because half the people with iphones (Score 1) 264

don't need 16Megs. People on slashdot criticize apple for forcing you to buy features you don't need. Now you critize apple for making the base model something not geek worthy. they are offering what their customers need. Chances are the number of songs or photos you want to keep stored on your iphone at any time isn't geoing with time. and that's the majority of the space usage on most people's phones. With icloud and beats streaming that need is going to dramatically shrink as well. The only thing likely to really be a space hog is more tricked out games and things that use the greater pixels of the large phones. But as I said, at the moment it's photos and music that dominate the storage needs and those will be going down not up.

Comment Re:Alibaba's AliExpress store is ripe with fakes (Score 2, Interesting) 191

Yes alibaba is a theives market. Alibaba does little to root this out too. Moreover the entire china small items trade competiveness relys on the rediculous postage rates (low) that allows delivery in the US for a mere $1 worth of postage. Finally all the small vendors lie about the item in the postage to evade customs charges.

Amazon could make great noises and will.

On the other hand who owns Alibaba's 120 billion? Americans now. If the congress sicks their dogs on ALibaba it's the same as pilfering 120 billion from investors.

Meanwhile amazon has a PE nearing 1000 (who are they kidding?). AMazon's 1000 PE is justifed only on the basis of their growth rate not their earnings. If their growth is threatened (enter alibaba) their stock price crashes. if it crashes to a P/E ratio of 30 or 100 then 90% of the stockholder calue is whiped out. Gone. Not transfered. Gone.

So what's your poor bribed congressman to do. Act on alibaba's theivery to save Amazon, or not?

tough choice.

Alibaba's stock price over the next year will be a race between their growth in value, and the trees Amazon and E-bay fell in their path. I predict it goes up for 1/4 then down in response to regulatory pressure after the elections. THen eventually back up if their revenues grow,.

Comment Re:Flash and Silverlight (Score 1) 61

Frequently the bank forces the user to use exploitable means just to communicate with the bank.

IE6+ActiveX required, anyone?

If your bank requires you to use that steaming pile of fail, why haven't you left yet?

Wells Fargo used to throw up warnings when you used a browser they hadn't yet evaluated, but I think the rapid-release schedule taken by most browser vendors put a stop to that. Even then, it was just a warning...it didn't affect functionality.

Comment Re:Paid advertisement (Score 1, Insightful) 48

If you told me someone was selling draft beer supplies (or whatever this crap is), my first assumption would be that it was for bars and taverns, not for home use. Thanks for taking time to point out the obvious.

I take it you don't know any homebrewers, then. Kegging is a hell of a lot easier than bottling. That said, the usual insurance against a keg running out is...wait for it...having a second keg on tap. Cheap and low-tech.

Comment Re:Everyone loses (Score 2) 474

Why would they renege? Because they can, because they haven't yet delivered, because there is now nothing forcing them to deliver, and because they historically misrepresent both what they promised previously and what they are actually doing.
Don't believe an aggressive negotiator unless you are inspecting their actual deliverables.

Comment Re:Nope they are clever (Score 1) 336

Apple has locked it down? So what? How is that any different from the last several years where competitors have had NFC and payment support?

When the ISIS Association initially locked down NFC, it only locked down access to the NFC secure element. In other words, third party developers were still able to use NFC for other purposes, than making payment applications with it. In that sense, Apple is far more paranoid and repressive than ISIS itself.

As a user, I personally couldn't care less about the latest power struggle between big players. I just like to be able to read my Clipper card with it. And I just like to pair with my speakers/my headset, or my friends devices, without having to even think about it (or without being forced to buy NFC Bluetooth speakers at twice the price because they an exclusive deal with Apple).

Slashdot Top Deals

Understanding is always the understanding of a smaller problem in relation to a bigger problem. -- P.D. Ouspensky

Working...