Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
×

Comment Re:root = same process (Score 5, Informative) 130

Gatekeeper also isn't "all MacOS X security". There's separate malware detection, and in order to do much of anything the user has to enter their computer account password.

It's a minor part of OS X security, mostly designed to keep casual users from installing stuff outside the apple store.

Yes.

There's also Mandatory Access Controls (MAC Framework) in the kernel itself, and there's BSM secure auditing in the kernel itself, and there's discretionary access controls, such as standard UNIX permissions, and there's POSIX.1e draft (it was never ratified as a standard) ACLs, and then there's whatever malware detection or antivirus protection you've jammed into the kernel as a MAC module via a KEXT, and in the absence of any access controls whatsoever, it's default deny, and then there's code signing, and encrypted pages within executables.

They didn't bypass any of that, and they wouldn't really be able to, even if they were root, because you can't get the Mac port for the kernel virtual address space without jumping through a massive number of hoops (which is why jailbreaking phones is non-trivial, and everyone uses script kiddy tools to do it, instead of jailbreaking from scratch).

And yeah, it's pretty stupid that Gatekeeper or anything else would be running as root and thus be exploitable with the escalated privilege available at install time, since it'd be pretty easy to just have it run as a role-based account, and have the kernel's cooperation, after cryptographic verification of the developer keys at the kernel level. But that doesn't let you bypass "All OS X Security": getting root doesn't really get you nearly 1/10th of the security bypassed (less, if you've installed third party anti-malware KEXTs that refuse to be unloaded except in single user mode during boot as part of an uninstall script, and are therefore always active).

They clearly do not understand the concept of "security in depth".

Comment Personally, I don't think he was talking to Google (Score 5, Interesting) 349

Personally, I don't think he was talking to Google; at least not directly.

He got called by a recruiter, supposedly for Google, who set up a phone interview Looking for C/C++ and Java. Fine. There's an outside chance of Java, either as an Android App developer, or for some server back end crap at a company they purchased. It's unlikely, but it's possible (in 2011, they hired people to work at Google, and then groups decided to offer them, and then you got a choice of usually one of 3 groups... you didn't know what you'd be working on at interview time, and there was no such thing as "hiring for position" unless you were net.famous).

Then he didn't get sent a Google Docs link by the interviewer. You are *always* sent a Google Docs link by the interviewer, unless you are in a city/area where Google has a facility, then you are instead brought in to use the video conferencing at the Google location.

Then he got an interviewer who barely spoke English, and wouldn't take him off speakerphone. That never happens at Google.

The interviewer was 10 minutes late to the call.

Frankly, sir, IMHO, you got played.

You just got man-in-the-middled by an Indian or other foreign person who wanted a job at Google, and got you to ghost his or her phone interview for them, with the help of a "recruiter"/"interviewer" who had you on lousy speakerphone so that they could relay your answers directly via a cell phone to the person Google was actually talking to.

Yes, this happens.

No, savvy technical people generally don't fall for it, because they get an email from Google telling you the schedule, there's a Google Doc URL sent out with an @google.com address, and if you look at the email headers in the email of the schedule, you'll see that they are probably forged, assuming you got one at all.

Congratulations on being played, Mr. Robert Heath.

Comment Deccan Traps (Score 2) 152

A super volcano could be extinction event if it is big enough.

Not unless it is a lot bigger. The one that occurred around the time of the extinction of the Dinosaurs gave rise to the Deccan Traps.

To put the scale of this extinction-level eruption in context the article mentions that the new, larger chamber under Yellowstone contains enough magma to fill the Grand Canyon which according to here is 4,170 cubic kilometres. The Deccan trap eruptions produced 512,000 cubic kilometres over 30k years. A Yellowstone eruption would certainly cause a lot of devastation over a large area of North America but its peanuts compared to an extinction level event.

Comment Re:It's hard to credit the behavioural science cla (Score 1) 198

Which is probably why it's a good idea for the Feds to fund it instead.

Because if the feds fund it, and the research gets actual results we don't already know, Microsoft is going to run out and implement it and make the next version of Windows the same headache for themselves that XP has been turning out to be?

What does it matter *who* funds it, if no one implements anything based on the results (if any) of said research?

Scratch that... I guess it matters to currently unemployed behavioural scientists, although they are likely more concerned*that* it's funded, rather than *who* is funding it...

Comment Re:So let me get this straight (Score 1) 686

The claims that Snowden attempted to use the proper channels are disputed by the NSA. I think it's extremely likely that Snowden's version of the story is closer to the truth, but I have to keep in mind that there's some uncertainty there. The outcomes of the leaks are harder to dispute, and I think the net effect was a positive outcome.

And I still recall Obama's speeches that change had to come to Washington, not from it. Heh. But did he live up to his campaign promises any less or any more than other presidents have? I guess good presidents need to work with compromise and internal politics well while in office. I think Nixon was pretty good by that measure.

Comment Have to wonder if this has something to do with... (Score 1) 368

Have to wonder if this has something to do with the interposing https phased rollout by Comcast for their CloudFlare based CDN that they use for web acceleration to reduce their peering overhead. It was preventing me from getting to e.g. LinkedIn and Amazon.com for a couple of days, until they had the kinks worked out. I'm told that I was in one of the "early rollout areas".

Obviously, no one complaining about this gives ISP or other useful diagnostic information in their postings, so it's impossible to give them a good technical answer for their problems, since the problem statements are all lacking in technical information.

This may help; I'd suggest a rename, rather than a delete on the cache stuff, though - in case that's not it:

https://support.apple.com/en-u...

Comment Cut the rhetoric, look at the evidence (Score 0) 341

Contrary to your argument, those who receive the chickenpox vaccine seem to have proven to have a lower risk of shingles [cdc.gov] (scroll to "Risk Factors").

...and yet the vaccine prevents those people who already had Chicken Pox as a child being re-exposed to it the virus later in life which has been shown to prevent shingles in adults.

Now I could accuse you of spreading lies and deceit but really that would be behaving exactly like the anti-vaxxers: adopting a preconceived notion, ignoring all scientific evidence to the contrary and getting mad at anyone who disagrees. So how about we adopt a more scientific stance which is that for the specific case of the Chicken Pox vaccine there is no clear evidence that it is a net benefit to individuals or society over just catching the disease as a child and recovering? The risk of the vaccine is not measurably less than the risk of the disease and there are clear questions about the net affect of susceptibility of adults to shingles: it might be good or it might be bad but we really don't have a clue either way.

My position is that if there is no clear evidence for any benefit from a medical procedure then you don't do it. If that changes with more studies and they can show that there is a clear benefit then great I'd be 100% behind it. In the meantime I would argue that it is unethical to coerce people into undergoing a medical procedure for which there is no evidence of a net benefit to them or to society. Worse, because in this one specific case, the evidence is lacking you give the anti-vaxxers ammunition which they can use to shoot at the cases where the vaccine is incredibly beneficial and absolutely should be taken by everyone.

Comment Re:c++ 14 eh? (Score 1) 78

It does not necessarily imply efficient memory management, though, since it is only guaranteed that the memory will eventually be freed, rather than as soon as it is actually unneeded.

No, it's all reference counted, meaning that as soon as the object goes out of scope, the reference count decreases, and if it hits zero, the memory is freed right then and there. It doesn't work like languages with managed memory and a garbage collector, such as Java or C#. When memory gets freed is 100% deterministic.

Of course, if you mean that you could lose track of shared pointers, that's true enough. But that's also true in *any* language that I'm aware of, so C++ is no different in that regard. No language will succeed against the wiles of a terrible programmer.

Comment Re:More things in space (Score 0) 154

Hey, they're right. Where do you think all the "Humans aren't causing Global Warming" "science" comes from. Sure it's atrocious science, but as long as someone with a Ph.D. and a lab coat is telling people what they want to here, plenty won't look too to see if they're actually scientists or just sciency PR flaks.

Comment Re:Disgusting. (Score 1) 686

I can remember when my generation was against The Man too.

No, you got it wrong. Well, you are correct in that - when we were younger - it was our generation who fought against "The Man". We did this by throwing our support behind the New Guy who would rid of us of "The Man". And thanks to us, eventually, the New Guy ousted "The Man" and all his old-fashioned notions, enacted policies we supported, and we were happy. But then the New New Guy started making noise, winning the support of the next generation, and foolishly calling our New Guy "The Man". But that's just ridiculous. Our New Guy isn't "The Man"; that's the people our parents supported!

So you see, it is not that our generation has become any less less open-minded and rebellious; after all, we got rid of "The Man". It's just that we already put the proper people into power and can recognize these New New Guys as the loud-mouth troublemakers trying to lead our children astray for what they are.

What Dad, you thought "The Man" was a New Guy too and you were fighting for truth 'n' justice and the American Way? Now that's just silly; obviously you are just being conservative and bitter. ;-)

Comment Re:c++ 14 eh? (Score 1) 78

I think you misunderstand me a bit. I'm not saying to start with C++ 11 vs 14 as a language, only that you're going to get better results searching for C++ 11 on the internet when trying to find tutorials about how to use most of those new features. Most of those new articles were written when C++ 14 was not yet ratified. No one wrote new tutorials about how to use shared_ptr when C++ 14 was released because nothing really changed in terms of the basics.

Incidentally, I would never advocate the "progression" approach myself. When teaching C++, there's zero need to teach C first (I learned C++, then C), and starting with C++ 98 would be insane nowadays. Keep in mind that I'm just talking about the order one should learn the new features of the language, not a specific version of the language itself. It just happens that for someone migrating from C++ 98 to C++ 14, the features introduced in C++ 11 are far and away the most important for about 95% of your day-to-day programming needs.

I can think of only one C++ 14-specific feature that would be good to know off-hand when starting out, which is that there's now a std::make_unique() function, just like std::make_shared(). Everything else can wait until you've learned the core new features.

Slashdot Top Deals

"May your future be limited only by your dreams." -- Christa McAuliffe

Working...