Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×

Comment Re:Article is Troll **AND** Flamebait all in one! (Score 1) 642

It's not just "the ones who fail the metal detector" who get pat-downs, and that's not what the article is about. The TSA is increasingly using backscatter x-ray machines; if they decide to put you through one of those, you can opt to get a manual pat-down instead. This is the category of people we're talking about; they are trying to get more people to choose the backscatter x-ray by making the manual search more uncomfortable.

As for there not being enough scanners, TFA says "Agents were funneling every passenger at this particular checkpoint through a newly installed back-scatter body imaging device." I can confirm this; the last few times I've been to Logan Airport in Boston, they were putting every adult through the scanner. (They allowed a few small children to go through the metal detector instead.) Perhaps this is true only at some airports or only at non-peak times, but there are certainly situations where everyone gets funneled to the backscatter machine, and opt-outs get patted down.

The second time this happened to me, the TSA agent announced that we would go through the scanner, and didn't mention that anyone had the option to get a manual pat-down instead. When I politely requested to opt out of the scanner, the TSA agent kept trying to talk me out of it, repeatedly asking why I wanted a pat-down, informing me that it would be degrading, etc., before finally allowing it. (Honestly, one of the reasons I wanted to request a pat-down was so that other people knew it was an option!)

Comment Re:So funny.. (Score 1) 684

it would be more work to re-engineer somebody else's code to avoid detection than to just write it from scratch.

Very true. I've been a TA in CS at a well-known university, and it's surprising how many students don't realize how easy it is to catch cheaters.

Much of our work is cooperative--either explicitly group work, or of the "you can talk with friends about the ideas or help them debug, but write it up yourself" variety. In addition, the TAs are available for any questions (and don't mind helping you--really!). So, it's really not that hard to do the work honestly and do ok. Maybe you won't do great, but you'll do ok.

But I never saw the people who ended up cheating during office hours, or saw other signs that they were putting forth any effort to actually learn. So I don't think cheating is a matter of ability so much as laziness. The issue, as parent rightly points out, is that while it's certainly possible to cheat in an undetectable manner, doing so requires at least as much work as doing the assignment. And if someone is cheating due to laziness in the first place, they often don't put much effort into cheating, and it's very, very easy to catch them.

If you are too stupid to realize that when you hand in plagiarized code, you aren't taking a *risk* that you will be caught, you are engaging in the certainty that you will be caught, then you don't deserve to be at a university of this caliber.

I'd agree, but sadly the full consequences don't always filter through, because departments and institutions make it hard. One of my students once blatantly cheated on a large final project. As a TA, I would have supported very harsh penalties. I was a bit let down when the professor gave a lesser penalty...and mentioned the reason for it to me: ultimately, if the professor tried to institute a penalty with long-lasting academic effects, it would mean a ton of paperwork and annoyance on the professor's part. I don't blame the professor for this (since I know how much he really had going on at the time), but I think the department should have made it a bit easier for people to deal with cheaters.

Comment Re:Oldbar (Score 2, Interesting) 447

Install the "oldbar" add-on.

In any discussion of the awesome bar, someone always mentions oldbar, and someone else always mods it informative.

The description of oldbar is "oldbar makes the location (URL) bar look like Firefox 2" (emphasis added). It does not change functionality, only appearance. rantingkitten--and I--have complaints about the functionality first and foremost. oldbar doesn't help.

I could go through a litany of complaints about the actual functionality (ridiculous prioritization decisions, various forms of nondeterminism that don't make consistent sense even if you accept the prioritization decisions, etc.), but ultimately my complaint is the same as grandparent's: There's no way to turn it off. And by "turn it off" I don't mean "make it look different while retaining AwesomeBar functionality" or "disable location bar dropdown altogether" (as replies to this complaint typically suggest). I mean "revert to the previous, predictable, sane functionality."

Currently, I'm approximating the previous functionality with a number of obscure, poorly-documented about:config tweaks, but 1) why should you need to go through that to provide a vague approximation of the user experience you had in the previous version, and 2) it's not perfect; there's still strange behavior.

Sure, have the awesome bar. Sure, make it the default--a lot of people like it. All I want is a checkbox to revert to the previous behavior, that's all.

Comment Re:Voting needs to be transparent (Score 1) 207

If you can confirm your vote, you can prove how you voter to others. This makes room for buying and extorting votes! I can imagine some employers requiring you to prove you voted correctly to keep your job.

Or union bosses. Or the local political-organizing group slipping you some money in exchange for voting a certain way. Or even an unorganized gang of thugs trying to intimidate you (think a group of rednecks who suspect you might have voted Democratic, or a group of Berkeley hippies who suspect you might have voted for Prop 8).

But I disagree with your first sentence. It's certainly true about the scheme proposed by GP, but contrary to intuition, there are ways to confirm your vote without being able to prove how you voted to others.

Such voting systems typically use a "cut-and-choose" method in which your vote is split into two or more pieces, any one of which is useless for determining how someone voted, yet together create the full vote. The voter takes a copy of one of the pieces as a receipt and can verify that the piece was counted correctly. So if there are two pieces overall, someone trying to tamper with the votes would have a 50% chance of being caught for each vote tampered with, which quickly becomes negligible for any significant number of votes. Yet the voter can show the piece to others, and it doesn't give any information about how they voted.

Here (PDF) is one method for doing this, by David Chaum.
Here (PDF) is another (without cryptography!), by Ron Rivest.

The issues with these new systems seem to be usability, inertia, and public trust. Usability: Voting should be extremely simple for the voter. If Great-Grandma can't do it, it's not going to be our voting system.
Inertia: Current election systems seem to be "good enough" for most people; despite some agitated geeks and the occasional news story about voting machines being laughably insecure, there isn't a huge popular movement to change. (Cost of switching systems can also be included here.)
Public trust: Even if cryptographers agree that a system is secure, if the system involves a user experience any different from the familiar "check off from a list of names" protocol, they'll have to work to convince the lay public that it's ok.

Comment Re:So how does a country club work, legally? (Score 3, Informative) 198

Legally, the difference between a bar and a country club is that the bar is what is frequently referred to as a semi-public space. That is, it is private property, but is open to the general public. Restaurants, shops, etc. typically fall into this category.

Owners of semi-public spaces do have some rights to control their property (e.g. enforcing a rule that they'll kick you out of the store if you don't buy anything, or a movie theater not allowing kids into a theater hall that is currently showing an R-rated film). However, they have fewer rights over the property than owners of private spaces do (e.g. they can't prevent someone from entering solely based on their race).

A country club is typically a fully private space--while there are procedures for gaining access, the general public is excluded. A bar is a semi-public space--there is a general expectation that it is "open to the public" (subject to legal age restrictions). Your proposal of "membership" might be seen as an attempt to make a bar a letter-of-the-law private space. IANAL, but I'd expect it to fail in one of two ways:
1) Someone could legitimately argue that the temporary "membership" is basically a farce and the bar is still a semi-public space, since the general public can--and, indeed, is desired to--still access it by gaining trivial membership.
2) There may be zoning restrictions involved. Bars are frequently located in commercial zones; cities may require any businesses operating in the area to be semi-public.

Comment Re:And yet (Score 1) 493

What's more, you shouldn't have to dig around in about:config to change a setting that doesn't actually do what you want.

The max rich results setting just means it won't display any search results. That's not even remotely the same as going back to an old-school auto-complete functionality.

Exactly. (Mod parent up.) There is no way to disable the Awesome Bar in the sense that d3ac0n means, i.e. returning to a sensible autocomplete dropdown rather than the search-based algorithm it uses now. And there apparently won't be, given that this bug is "RESOLVED WONTFIX".

To be fair, I hated it at first (and at times I still do) but while it sometimes has completely random matches, there are a number of sites that I can now get to much more easily, even without having bookmarked and tagged them. About the only thing that I do always do is use the oldbar extension as a basis for my CSS to get a slightly more sensible appearance (i.e. something that doesn't go half way down your screen with half a dozen results).

I don't hate it as much as I used to, and I recognize that 95% of users love it, but I'd still switch back if I had the option. I have miscellaneous usage problems I could rant in detail about (and yes, I have "trained" it--I've been using FF3 since Download Day), but my biggest problem is philosophical: it breaks expectations. The location bar is for typing locations. If I start typing a location, if it employs any kind of "smart" searching technology, then I can't predict what will be in the dropdown--whereas a bar that simply autocompletes rather than searches is predictable and useful.

In the WONTFIXed bug, the developers encourage feedback about how to make the awesome bar customizable, how to change the weightings applied to the search function, etc. They completely miss the point that no amount of tweaking and preference-weighting will make an algorithm that can exactly predict what I want 100% of the time. The entire premise of "search" in the location bar is flawed.

Admittedly, that's my opinion. And as I mentioned above, I recognize that the vast majority of people like it. I don't ask for it to be removed, or for it to not be the default. All I ask is for the option to revert to the old behavior.

Comment Re:Spam? (Score 1) 430

I could understand citing the political blogosphere as a whole, but to specifically mention the Huffington Post is just creepy. It's neither revolutionary nor reputable.

It is, however, the source of the best news correction I've ever seen:
"UPDATE: The Huffington Post has learned that the below video has been doctored. We regret the error and apologize to Mr. Gibson. John Gibson never compared Eric Holder to a monkey with a bright blue scrotum." Source

Comment Re:Ummmm (Score 4, Interesting) 79

You don't, and as scientific proof of the Earth's rotation, this is obviously completely useless. But if you trust the motor, this is a fun way to see what a Foucault pendulum does, without the expense and inconvenience of needing a full-sized model.

True enough, but if you ever want to show it to others, there will be skeptics.

I once saw a full-size Foucault pendulum at a science museum. If you stood and watched it for a few minutes you could see the precession (there were markings on a ring around the pendulum, so it was easy to see where it swung before). I overheard some other patrons asking if it was powered, why it didn't come to a stop, etc. The museum guide explained that it was not powered and how it worked, and mentioned that because of air resistance they used an electromagnetic ring to give it a tiny "push" with each swing to keep it going. He also explained that because the magnet was circular, it would always push the pendulum directly back the way it came rather than from side to side.

Several onlookers remained convinced that it was a trick and the electromagnet was causing the precession. And remember, these are people standing in a science museum, looking at an exhibit so massive it required the entire building to be designed around it, whose entire point was to show this effect.

Now imagine if there had been a motor attached to it, designed to "compensate for ellipsoidal motion"....

Comment Re:Already got one (Score 1) 125

Indeed. Google's PageRank algorithm started off as citation analysis for academic papers--one could find out which papers were notable in a given field by the quantity and notability of the papers citing it. Then they realized that the same approach could work for the Web, treating links as citations.

As a sibling post points out, this says nothing about the correctness of the paper, only its notability--but ideally if a paper is shown to be faulty, then the paper exposing the faults will get many citations too.

The proposed system might give a more detailed granularity than a purely citation-based system, so in that sense might have a reasonable benefit. However, as a "social network" of sorts, it will tend to have a life of its own, and consequently could very easily be subject to failings at the social/political layer (as other commenters have noted).

Encryption

Submission + - Rogue CA Certificate Created from MD5 Collision

LargeMythicalReptile writes: A team of researchers has successfully used weaknesses in the MD5 hash function to create a rogue CA certificate that appears to be signed by one of the common root CAs. According to them, "We have identified a vulnerability in the Internet Public Key Infrastructure (PKI) used to issue digital certificates for secure websites. As a proof of concept we executed a practical attack scenario and successfully created a rogue Certification Authority (CA) certificate trusted by all common web browsers. This certificate allows us to impersonate any website on the Internet, including banking and e-commerce sites secured using the HTTPS protocol."

Comment Re:Triple MD5 Anyone? (Score 2, Informative) 125

Several points about this:
-DES was never algorithmically broken--it was just designed with too small a key size. 3DES effectively doubles the key size to something reasonable. MD5, however, is actually broken--it has algorithmic weaknesses that can be exploited. Thus, it's not an analogous case.
-We know a lot more about hash functions now than was known when MD5 was designed. From new attacks (e.g. multicollisions) to new design techniques (e.g. HAIFA), there's a lot more knowledge for cryptographers to use.
-As a corollary to the above, any new algorithm, even your 3MD5, would require application support. If we're going to ask people to code that up, why not get something entirely new?
-Finally, practical considerations. NIST wants something flexible for SHA-3, and there are various requirements that are not met by the above proposal. (Digest size from 224 to 512 bits, for example.) There are additional implementation considerations that make your proposal worse than MD5 itself--notably, the requirement that the bytes be read three times in various orders. Just about every practical hash function proposal (including all the major existing ones, and all the SHA-3 candidates I've looked at) is computable "online"--that is, it can be computed in a single pass reading through the message. It doesn't require multiple passes or even keeping the entire message in memory at once.

In short: NIST is looking for something better than SHA-2 (and definitely better than SHA-1). 3DES was a good idea because DES itself was still good, but in this case it's better to start fresh than throw a random patch on an old-and-broken algorithm.

Read the Federal Register notice to get an idea of what NIST wants out of this. It's a lot broader than "a patch on MD5."

Slashdot Top Deals

It is easier to write an incorrect program than understand a correct one.

Working...