Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
EU

Microsoft Lets EU Governments Inspect Source Code For Security Issues 143

itwbennett writes: Microsoft has agreed to let European governments review the source code of its products to ensure that they don't contain security backdoors, at a transparency center in Brussels. The second of its kind, the new center follows on the heels of the first, built last June in Redmond, Washington. Part of Microsoft's Government Security Program, the company hopes the centers will create trust with governments that want to use Microsoft products. "Today's opening in Brussels will give governments in Europe, the Middle East and Africa a convenient location to experience our commitment to transparency and delivering products and services that are secure by principle and by design," said Matt Thomlinson, Vice President of Microsoft Security.

Comment Re:how can we trust facebook? (Score 1) 138

Facebook is not doing encrypted messaging between users. Did you RTFA at all?

i did indeed... but it obviously wasn't clear enough. i believe that would come from the subject line saying "facebook is sending encrypted emails", rather than the subject saying "facebook allowing you to receive GPG-signed administrative notifications by email".

Comment how can we trust facebook? (Score 1) 138

errr, so i want to send a communication, ok? it's supposed to be private, right? but it's a web service: facebook could, at any time (even under secret fascist subpoena) change or be forced to change (without informing us) the user interface so that the encrypted message is no longer encrypted, but is in fact entirely in cleartext.

you might think, "ok, well, surely we could then just have a messenger service or app which does the job, and we could trust that, right?" and the answer is "well no, absolutely not you can't... not unless the entire source code is available, and a chain of trust is established that guarantees a verifiable and traceable compile and distribution chain".

which, basically, means you need a software libre distribution (such as debian) because those have full source available, and GPG-signing right the way from the developers (whose identities are verified via key-signing parties that involve showing proof of ID on each signing), all the way through to distribution where a "Release" file containing the MD5 checksums of every package is, once again, GPG-signed by provably verified individuals.

the bottom line is that just because facebook *says* it's secure doesn't actually make it so, and announcing "yeah we provide a secure encrypted email service" is actually a dangerous DISSERVICE. you can't *EVER* guarantee that the servers have been compromised, and web browser *implicitly* trust what the servers give them to run.

the best thing that facebook could do is provide a programming API via which encrypted emails *may* be sent, and then sponsor software libre teams such as mutt, and everyone else, to provide 3rd party (entirely software libre) applications that deliver *and receive* encrypted mail. the only hurdle to get over there would be whether the software libre teams would view working with facebook to be endorsement of SaaSS (service as a software substitute - http://www.gnu.org/philosophy/...) which i can guarantee in advance that any GNU project will *not* do.

Comment Re:Not the same, but I guess the best we can do (Score 1) 73

I'm afraid that willfull, destructive ignorance and barbarism isn't a problem that technology can solve. A digital copy, however perfect, remains a copy, and by nature, can't be used as proof that there ever *was* an original, which is the entire purpose of ISIS's destruction of these relics.

i disagree, outright. their aim is to destroy availability and access to anything that could cause people to have "thoughts" outside of the proscribed and permitted range as dictated by them. in that regard, it *doesn't matter* that the copies are imperfect replicas of the original.

in fact, now that i think about it: a second objection to what you say is that if anyone else notices a discrepancy, they may take a copy of the files and improve on it. so in that regard, the fact that these insane people have endeavoured to destroy the originals actually results in *more* people with access to - and thus thinking about - the origins of the artefacts that were destroyed.

either way, these insane people have *helped* spread the messages that they attempted to suppress. so i think i will mark this story as "stressandeffect".

Communications

Orange County Public Schools To Monitor Students On Social Media 166

The Orlando Sentinel reports that Orange County, Florida, is undertaking a sweeping effort to snoop on the social media communications of the county's public school students and staff, for the nebulous task of "[ensuring] safe school operations," and say they will use the software (at a license cost of about $13,000 per year) "to conduct routine monitoring for purposes of prevention or early intervention of potential issues where students or staff could be at risk to themselves or to others." The software they're using is from Snaptrends, which offers "location-based social media discovery." According to one of the comments attached to the linked story, there are monthly fees, in addition to the annual licensing cost.
Censorship

Artist Uses 3D Printing To Preserve Artifacts Destroyed By ISIS 73

tedlistens writes: "From the burning of the Library of Alexandria to the destruction of the Buddhas of Bamiyan in Afghanistan by the Taliban, to the Nazi's battle to burn as much "degenerate art" as they could find, mobs and soldiers have been quick to destroy what took societies centuries to create; what museums and collectors spent decades collecting, preserving, and documenting for the public." However, as noted by Motherboard in an article to which tedlistens links, "The digital era looks different: files can be cheaply hosted in data centers spread across several states or continents to ensure permanence. Morehshin Allahyari, an Iranian born artist, educator, and activist, wants to apply that duplicability to the artifacts that ISIS has destroyed. Now, Allahyari is working on digitally fabricating the sculptures for a series called "Material Speculation" as part of a residency in Autodesk's Pier 9 program. The first in the series is "Material Speculation: ISIS," which, through intense research, is modeling and reproducing statues destroyed by ISIS in 2015. Allahyari isn't just interested in replicating lost objects but making it possible for anyone to do the same: Embedded within each semi-translucent copy is a flash drive with Allahyari's research about the artifacts, and an online version is coming.

Comment trees cut down in the cities (Score 4, Interesting) 155

i visited bangalore in 2006, to see a friend living there. he explained that when the trees were cut down in the cities (so that more housing could be built), temperatures soared by an additional 10 *centigrade*. so, the ambient temperature surrounding the cities would be 45 degrees, but in bangalore it would reach *fifty five* centigrade. the point of mentioning this is that it's a much more direct version of how man has an effect on his immediate environment. change the landscape, you change the weather, it's as simple as that. we can learn from that... or simply die. it's our choice.

Comment tried and failed... and prior art anyway (Score 1) 102

hang on... didn't bunnie huang do the "chumby", and didn't barbie try doing something like this - putting an interactive wifi and mic aspect into one of their barbie dolls... with a huge back-lash as a result? so (a) why is there an expectation that this will succeed (b) why was the patent granted when there is clear prior art???

Comment debian digital signing and the GPG keyring (Score 2) 94

this is why debian has the GPG key-signing parties, and why all packages are GPG-signed by the package maintainer when they compile it, why the ftp masters sign the package when it's uploaded, and why the release files which include the checksums of all the packages are also GPG-signed. under this scenario there are an extremely limited number of extremely paranoid methods by which debian may be compromised. even the scenario of "cooperation between long-term sleeper agents within debian's ranks" would have a one-shot opportunity to get away with introducing malicious code, following the discovery of which their GPG keys would be revoked, the perpetrators kicked out of debian, their packages pulled immediately pending a review, and the already-effective procedures reviewed to involve multi-person GPG signing that would make it even harder for compromise to occur in the future.

now, if you recall, there was an announcement a couple of years back that the development of Mozilla's B2G was declared to be "open" to all, so i contributed with a thorough security-conscious review of how to do package distribution. it turns out that Mozilla is *NOT* open - at all. several other contributors have learned that the Mozilla Foundation is in direct violation of its charter.

basically, the Mozilla Foundation *completely* ignored the advice that i gave - which was that the use of SSL as a distribution mechanism would be vulnerable to *exactly* the kinds of attacks that we see the NSA attempting to do on google. they went so far as to enact censorship, preventing and prohibiting me from pointing out the severe security flaws inherent in their chosen method of package distribution. i remain deeply unimpressed with many aspects of so-called "open-ness" of well-funded software libre projects.

Comment correlation between gravity and length of day (Score 1) 95

http://iopscience.iop.org/0295...

just to throw an appropriate spanner in the works, it's worthwhile mentioning the above article which notes a significant statistical correlation between variations in the measurement of the effect known as "gravity", and the (appx) 6.5 year cyclic variation of the earth's length of day.

now, before you go all "ooer" or "waah! gravity varies! we're all gonna dieeee spinning off into space", it's worthwhile pointing out that the author mentions, in the conclusion, that there *might* be some sort of unknown systemic errors in (a) how gravity is measured (b) how the length of day is measured which *happen* to coincide and give the *impression* that there is a statistical correlation between gravitational variation and the length of the earth's day. he does however state that in light of how the measurements are taken it would seem to be very unlikely that there are such systemic errors.

so, anyway, the point is: gravity appears not to be as simple as we assumed, hence why some long-distance space probes (Pioneer for example) have anomalous unexplained behaviour.

Cellphones

Pre-Orders Start For Neo900 Open Source Phone 134

New submitter JoSch1337 writes: After a year and a half of development, the Neo900 project now opened its web shop for the down payments of binding pre-orders for either a full Neo900 phone or the bare circuit board to upgrade an existing Nokia N900. The up-front down payment is necessary to now secure expensive "risk parts" like the modem, 1GB RAM and N900 cases. Thus, without pre-ordering now, there might not be enough parts left after the first batch.

The Neo900 is the spritual successor of the Nokia N900. The new circuit board can be placed into an existing N900 for better specs (faster CPU, more RAM, LTE modem) than the original device while still maintaining fremantle (maemo 5) backwards compatibility. Alternatively, a fully assembled phone can be purchased as well. The Neo900 will be fully operational without any binary blob running on the main CPU. While the modem still requires a non-free firmware, it is completely decoupled from the rest of the device (think of a LTE usb stick you put in your laptop) and can reliably be monitored or switched off by the operating system.

You can follow the development of the project in the maemo forum, read about the specs of the device or consult the FAQ

Comment Re:Sociopath (Score 1) 170

You'd find that people who aren't training to be pros, but work out that much, are probably more common than you think.

yep - count me in. i'm currently up to about the same level of exercise as you - about 2 hours a day: tennis or street-skating. tennis is for my eyes - and the social interaction. street-skating is because i find the explosive (sprinting) nature of tennis is causing huge knots in my arm and leg muscles. without this, i am... yeah, not a nice person either :)

Comment Tennis and Computing (Score 2, Interesting) 170

two years ago i took up tennis at the recommendation of a friend. before that i'd done tai ji, full-contact karate (shin kyu-kshin), long-distance skating (86 miles athens-to-atlanta 1999, 65 miles new york park 1999, 26 miles rotterdam 2006) and yoga (ashtanga and T.M Asanas). it's a big list of different physical activities, which have the following things in common:

* complex coordinated movement
* requiring or recommending very deep breathing (skating especially)
* very long and regular practice

the reason why i specifically love tennis is that in addition to these things it is necessary to not only be extremely physically fit but also, if you would like to win, you require strategy and planning both on and off the court. tennis is particularly harsh on the body in that it is a series of very short explosive sprints, standing still, *then* hitting the ball, and then doing it all over again.

also the types of movement required are *unbelievably* complex! serving involves *six* degrees of freedom of movement (x-y-z, rotation in x-y-z) in order to impart the maximum amount of inspired deviousness into a small yellow round object.

to fully understand why it was that, aged 44, i started this sport and now practice over an hour a day, you have to understand that prior to that i was sitting 12 hours a day in front of a computer screen: average distance approx 1 metre. for the prior 4 years that was a 24in imac, so the panorama i *initially* thought was great.... turned out to have caused extreme alterations in my eyes.

just over two years ago i discovered that my eyes had gone "prism". this is a new development: i've always had -0.75 astigmatism, but prism basically means that i can focus easily on an object that's 1 metre away, but if i look at something 3 metres or greater away i see *DOUBLE*. in the dark, i can't bring the two together.

the implications of that are that not only has there been physical damage caused by long-term computer usage but that there has also been *NEURAL* damage caused by long-term computer usage.

the bottom line of this story is, in this context, that this football player is being extremely sensible. if a few neurons get knocked out of place by a concussion, so damn what: his pursuit of mathematics will, by virtue of it being so incredibly challenging, allow him to grow new pathways and literally grow new neurons. the reason why his peers get brain damage is because they *don't* have anything other than football to challenge them.

each of his pursuits therefore supports the others. the physical exertion keeps his body - and his heart - fit. that in turn allows him more oxygen with which to feed his brain and thus sustain the pursuit of mathematics. the increased mental alertness allows him to play with tactics and strategy that the average player would not be able to consider. his specialty in mathematics would allow him to apply physics (moments of inertia) in a *really* practical way that would keep both him and the people he smacks down safer than would otherwise be done by someone without his knowledge.

but the best part of all this is that if he has a successful long-term career, i predict that he will end up inspiring thousands of young football players to pay a bit closer attention to their other studies, and that coaches will have an example - a specific person - that they can quote as to why, when they go recruiting, they are looking for someone who has not only the physique but also the high academic aptitude as well. ... wouldn't it be great to have an entire team of football players who not only kick ass (literally) but who have degrees and even PhDs? that would change how people think of football, forever.

Slashdot Top Deals

Never test for an error condition you don't know how to handle. -- Steinbach

Working...