Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Comment Re:CarPC (Score 1) 202

If it's removable, you can take it with you, I've no idea why you would leave it in the car.

Yeah, but then you have to lug an iPad around everywhere you go. It's not like it will fit in your pocket.

Conversely, regular car stereos, not designed to be taken with you when you get out of the car are (or were) notoriously easy to steal. I imagine the same would be true of an aftermarket car computer or DIY car computer.

I think this is still true of aftermarket car stereos though they usually have removable faceplates that you can store in the glovebox (or take with you, but then you have the same problem as the iPad of lugging it around everywhere). If the car computer is integrated in the dash, then you would have to take the dash apart or really slash it up to get at the computer (not that this is hard, but I don't think it's a simple smash and grab). If it's just a laptop sitting under a seat with an LCD in the dash, then yeah you're right.

Comment Re:Add-ons (Score 1) 202

He wasn't complaining about paying extra for the satnav, he was complaining about being asked to pay an absurd amount for satnav. When you can get a good standalone unit for ~$200, ~$4000 sounds ridiculous especially considering the screen already exists so the only things you are paying for are the receiver and the software. Sure you're going to pay more to have it done by the dealer and have it integrated with the rest of the car information system, but about 20 times the cost of a standalone unit sounds like a rip-off to me.

Comment Re:Yes, SHA1 security is questionable.. (Score 1) 217

In a system that correctly applies the salt, your new input will not generate the same hash. i.e., User sets Password, Password is hashed with the salt (e.g., passwordHash = hash(salt+password) ) You discover the resultant hash, You find a collision that produces the same hash ( hash(collisionValue) == passwordHash ) You then try to use this collisionValue to gain access to the system, but because of the use of a salt the system will take your collisionValue and add the salt, this will produce a completely different resultant hash and will not match the stored password hash.

hash(salt+collisionValue) != passwordHash.

Unless you know of a side-channel attack, or have access to enough hashes where you already know the password in order to determine the salt (or format of the salt for a roaming salt) then your collision is not effective.

Okay, so salt is more useful than I thought. For some reason I was thinking collision == access, but you're right that no one allows you to provide just the hash as that would be stupid (and pretty much defeat the purpose of hashing the password) and, as you state, if the stored hash is generated (and therefore authenticated) with salt, then your collision value won't give you access.

A well written explanation, thank you.

Comment Re:Yes, SHA1 security is questionable.. (Score 2, Interesting) 217

I think you misunderstand what AndrewNeo was saying. When you have the hash itself, you can then try to find some input that also produces that hash (a collision). You don't have to know anything about the original password or the salt.

As far as I can tell, salting only helps against rainbow table attacks. OP wasn't using those, he was computing the hashes (and thus finding collisions) using only the EC2 GPU instance. He was generating the tables themselves. Salt won't help you in that case. It just requires more compute power which has now become available thanks to the EC2 GPU instances that Amazon is offering.

Comment Re:Simple: (Score 1) 347

This guide is not by a lawyer, but it seems to have a good general overview of the law regarding photography (warning: pdf link). Basically there are four aspects to photography as far as the law is concerned. This is US law.

1) Whether you have a right to take a photograph (e.g. there are laws that restrict you from taking pictures of some military bases whether you can see them from a public place or not)
2) Whether you have a right to be in the place where you're taking the photograph (e.g. with Stonehenge I presume it's private property so you if you run on without paying their admission fee you'd be trespassing)
3) Whether you have a right to publish the photograph (e.g. you can't legally publish an image of a copyrighted work as your MoMA visit indicates though surely fair use would apply to parody or the like)
4) Whether you have a right to make money off the publication of a photograph (e.g. you can't sell a photo you took of Brett Farve without his permission, but there has to be more to it than that because the paparazzi are always selling celebrity photos)

In general, those four rights are unrelated. That is, you can be trespassing, but still be able to take a photograph and publish it, you just might be arrested for trespassing. As for British law, I have no idea what your rights would be. The government has video cameras watching you on the streets in London, but I wouldn't be the least bit surprised if I learned it was illegal for a the general public to take pictures of those same cameras.
Businesses

NY Times Confident of 'First Click Free' Paywalls 193

eldavojohn writes "One thing you might notice on Slashdot is that when someone submits a story linking to nytimes.com, it doesn't always work. While it's not truly a paywall, it appears to stop the user and require registration... sometimes. If you noticed this and it's seems to be non-deterministic in when and where it asks you to login, you're simply noticing the latest strategy of 'first click free' being employed. We've heard that normal paywalls are a miserable failure (the Wall Street Journal's, one of the more successful, only lets you see the first paragraph online). Will the drug pusher approach work out for The New York Times? The CEO seems to be certain that this blogger (and Slashdot) friendly paywall is the correct option and will keep The New York Times as a 'part of the conversation' online when news is rapidly circulating." I will tell you that if I am asked for a password, I almost always reject the story immediately, or go find a better URL. Heck, yesterday I rejected a NY Times story for this exact reason. So we'll see how it pans out.

Comment Re:I Left Out The Best Part (Score 1) 341

Essentially he is saying any scientist can be considered guilty of fraud if anything in their published papers turns out to be incorrect even if they believed it to be accurate at the time.

It depends on the timeline. Did Cuccinelli apply for the grant before or after the hockey stick debacle? Keep in mind Cuccinelli is not an author of the MBH papers, but the premise stands. You'd be guilty of fraud if one of the papers on which you based your proposal was found to be wrong. Though as far as I can tell, the hockey stick-like shape hasn't been invalidated. Some people just have a problem with the way the conclusions of the paper were stated. Plus, I don't see why investigating a claim, even if you think it's wrong, is bad science. You would then have evidence to support your idea that the original claim was wrong, or you get evidence to the contrary, or you just get more evidence that doesn't lead conclusively to either conclusion. Either way it seems like a win to me. Gathering more information and figuring out exactly what's going on with various phyiscal processes is what science is all about.

Google

The Effect of Snake Oil Security 110

Trailrunner7 writes "Threatpost has a guest column by Robert Hansen (aka Rsnake) about the long-term effects of snake-oil security products. 'I've talked about this a few times over the years during various presentations but I wanted to document it here as well. It's a concept that I've been wrestling with for 7+ years and I don't think I've made any headway in convincing anyone, beyond a few head nods. Bad security isn't just bad because it allows you to be exploited. It's also a long term cost center. But more interestingly, even the most worthless security tools can be proven to "work" if you look at the numbers.'"

Comment Typically overblown (Score 2, Insightful) 93

The manufacturer put abbreviated Scripture references on its parts. So what? If you didn't know anything about the Bible, it could easily be seen as just another part number. They're not forcing anyone to read the Bible or look up the Scripture reference. If a manufacturer wanted to put HHGTTG42 or THX1138 on parts or some other geeky reference, people would think it's cool. It's just as cryptic to anyone without "inside knowledge", but since it's a Bible reference, everyone gets their undergarments in a twist. It's not an endorsement of Christianity as an official religion by any government.
Games

Pirates as a Marketplace 214

John Riccitiello, the CEO of Electronic Arts, made some revealing comments in an interview with Kotaku about how the company's attitudes are shifting with regard to software piracy. Quoting: "Some of the people buying this DLC are not people who bought the game in a new shrink-wrapped box. That could be seen as a dark cloud, a mass of gamers who play a game without contributing a penny to EA. But around that cloud Riccitiello identified a silver lining: 'There's a sizable pirate market and a sizable second sale market and we want to try to generate revenue in that marketplace,' he said, pointing to DLC as a way to do it. The EA boss would prefer people bought their games, of course. 'I don't think anybody should pirate anything,' he said. 'I believe in the artistry of the people who build [the games industry.] I profoundly believe that. And when you steal from us, you steal from them. Having said that, there's a lot of people who do.' So encourage those pirates to pay for something, he figures. Riccitiello explained that EA's download services aren't perfect at distinguishing between used copies of games and pirated copies. As a result, he suggested, EA sells DLC to both communities of gamers. And that's how a pirate can turn into a paying customer."
Bug

Saboteur Launch Plagued By Problems With ATI Cards 230

An anonymous reader writes "So far, there are over 35 pages of people posting about why EA released Pandemic Studios' final game, Saboteur, to first the EU on December 4th and then, after knowing full well it did not work properly, to the Americas on December 8th. They have been promising to work on a patch that is apparently now in the QA stage of testing. It is not a small bug; rather, if you have an ATI video card and either Windows 7 or Windows Vista, the majority (90%) of users have the game crash after the title screen. Since the marketshare for ATI is nearly equal to that of Nvidia, and the ATI logo is adorning the front page of the Saboteur website, it seems like quite a large mistake to release the game in its current state."

Submission + - Apple says booting OS X makes an unauthorized copy 9

recoiledsnake writes: Groklaw has an extensive look at the latest developments in the Psystar vs. Apple story. There's a nice picture illustrating the accusation by Apple that Psystar makes three unauthorized copies of OS X. The most interesting however, is the last copy. From Apple's brief: "Finally, every time Psystar turns on any of the Psystar computers running Mac OS X, which it does before shipping each computer, Psystar necessarily makes a separate modified copy of Mac OS X in Random Access Memory, or RAM. This is the third unlawful copy." Psystar's response: "Copying a computer program into RAM as a result of installing and running that program is precisely the copying that Section 117 provides does not constitute copyright infringement for an owner of a computer program. As the Ninth Circuit explained, permitting copies like this was Section 117’s purpose." Is Apple seriously arguing that installing a third party program and booting OS X results in copyright infringement due to making a derivative work and an unauthorized copy?

Comment Re:w/r/t Windows (Score 2, Informative) 321

Actually, Microsoft has said it's only for application compatibility. Apparently a bunch of applications broke when going from 5.1, 5.2 (XP) to 6.0 (Vista). Why should Microsoft "lie to applications" and complicate things when they can just do what they did when going from 2000 to XP and change the minor number, as 91degrees said, version numbers are arbitrary. For what it's worth, I'm running the Release Candidate and it is a major improvement over the pre-SP2 Vista I ran for several weeks before reverting to XP.

Slashdot Top Deals

Intel CPUs are not defective, they just act that way. -- Henry Spencer

Working...