Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×

Comment Re:Doesn't really matter if they do patch it (Score 4, Informative) 629

As an unhappy lollipop user on a 2013 nexus 7 all I can say is don't bother. My free ram has dropped from 1gb to 400mb. I can't even keep two tabs of chrome in ram now. I'm seriously considering downgrading unless google gets this release right. Furthermore we are up to version 5 of android and there is still no way to push security updates? That's a pretty serious fail IMO. Google might want to rethink that strategy before it seriously burns them in the long run.

Comment Re: No control experiment (Score 1) 132

Not everyone has the same harm vs benefit outlook. You might want a perfect green earth but I like cheap energy today and can live with the health risks. We are all going to die someday and at least I want to be warm. So the short answer is, I don't care about your genes and you don't care if people freeze. To each his own. There is no "we".

Comment Re:So is the Internet Archive just a piracy site n (Score 3, Insightful) 198

And you're clearly going to be shocked if you ever learn how a library actually works.

Hint: the books (and CDs, and DVDs, and games) on the shelves are legally purchased copies, and are lent to a single patron at a time. They are not printouts of torrented epubs.

I love the Internet Archive but I seriously have no idea what they think they're doing here.

Comment Drug dealer business model (Score 5, Insightful) 124

The fine print on this announcement is that the patents are not really free. You have to apply and be accepted to the program (serious contenders need not apply?) and the royalty-free license period only goes to 2020. This is just enough time to develop and start producing something and then you can get hit with big royalty payments.
This is sucker bait.

Comment Re:Missing from my iPhone (Score 1) 421

You should look at DLNA more closely (note it's a certification of UPnP so you'll see things listed under that category too). It's very common, there are plenty of FOSS clients and servers (here's a small list), and it's been around for years. It does not require any new hardware - most devices & software clients capable of streaming media already support it (check the page I linked - something like 18000 models). It seems like you're raging against something which does exactly what you want - allows you to easily stream your local content to local or remote devices over an open & cross platform protocol.

The reason devices are less likely to support SMB is that DLNA exists, is easier to implement, and provides a better user experience. There's literally no reason (that I can think of) to use SMB.

Comment Re:Inexplicable gaps in Crypto products. (Score 1) 421

Well I've no idea what this has to do with smartphone apps, but I'll bite.

1) Most public key products do use symmetric encryption for actual data transfer. The public key bit handles mutual authentication and the generation and exchange of the symmetric key. Your approach does this ahead of time, by throwing a crap ton of them in a file and copying it to the remote host (via what, sftp?).

2) The advantage of public key crypto is that there is (or should be) precisely one copy of my secret (the private key), so I have some hope of being able to control it. In your approach there is one copy per host. In a non trivial deployment managing that file to keep it (a) private and (b) current is going to be extremely difficult. All I need is one copy of that file (or a portion of it) and I can snoop any channel and modify any message in transit. The use of UDP is puzzling as I'm pretty sure that makes message tampering even easier (although I'm not enough of an expert to say that for certain).

3) I don't see the point of the passwords/hashes on top of the keys. If I have the key I can communicate with you, if I don't I can't. Adding another secret which is in the same file as the key doesn't seem to add anything (for one thing, if I have the key and can listen in on messages I can easily extract the passwords as they fly by).

4) All the stuff about file "copy numbers" is meaningless as you are trusting the peer to tell you honestly which copy it has. Rule number 1 in network security is you never, ever, trust the other side. Listener copy numbers are "256 and up" so I can just make up a random number in the 100000 range and I'm very unlikely to collide with yours, so the check passes trivially.

5) There's no host level identity. How do I know I'm talking to the host I think I'm talking to? All someone with a copy of the key file has to do is change the copy number and they can masquerade as any host on the network (with an appropriate DNS/IP spoof or whatever). SSH prevents that because knowing one host's signature doesn't help you guess another.

6) There's no user level identity. Who is logging in to this box? Are they actually allowed to do so?

7) Changing the keys all the time is pointless. Assuming I'm using a good cipher, extracting the key from the encoded stream should be essentially impossible, so changing it likely won't improve security. Moreover, if I have one of your keys I probably have all of them, so changing it won't stop me. Further, having to allow for clock skew introduces complexity which is potentially exploitable. If you were generating random session keys dynamically and exchanging them out of band somehow then periodic rolling wouldn't be a bad idea (because I'd have had to crack the crypto to figure out the first key. and now I have to start all over again).

There's more I'm sure, but it's late :)

Comment Re:Missing from my iPhone (Score 1) 421

SMB streaming is a pain because you have to deal with whatever formats you might encounter, plus you have to maintain a local index of content etc if you want to provide any decent kind of UI. Every SMB based streaming device I've used (including very expensive ones) has sucked. DLNA is a much better bet as the server can abstract away all the complexity, and there are a bunch of dlna client apps for ios.

Comment Re:This is why I like Python so I can use OOP or n (Score 1) 303

There's absolutely nothing stopping you writing procedural code in Java, just put everything in one class and mark all your methods as static. Of course if you're going to start interacting with the class library you'll have to bend to it's way of thinking but that's not a _language_ thing. Of course I don't recommend doing that, but it can be done.

This is why an experienced developer has multiple tools at her disposal - Java is great (IMHO) for a lot of things, but I'll pull out Ruby or Perl for some stuff, C# for others (e.g. when I want a native windows UI), Scala for yet more. There is no one size fits all, and just because one tool doesn't do everything doesn't make it useless.

Comment Re:Don't mess with my jetset lifestyle (Score 2) 232

Globalism hasn't worked out so well for the U.S. Corporations have transferred a lot of skilled manufacturing jobs to low wage countries with fewer pollution controls and then ship finished goods back to the U.S. (creating more pollution). The result has been that the well paying manufacturing jobs have disappeared and everybody is working at Walmart for minimum wage selling cheap shit from China.
Globalization increases pollution and lowers living standards in developed countries. In low wage countries, they have more pollution. Wealthy people just buy more cheap shit, creating more pollution.
The only comparative advantage corporations exploit is their ability to drive down wages and not pay for their pollution.

Slashdot Top Deals

Intel CPUs are not defective, they just act that way. -- Henry Spencer

Working...