Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×

Comment Re:Antecdotes != Evidence (Score 1) 577

by angel'o'sphere (#48047985) Attached to: Will Windows 10 Finally Address OS Decay?

Fragmentation is a Windows myth.

Installed files belonging to the OS, never get moved or get changed. They don't "fragment". They are always on the exact same hard drive sectors.

User files are a different story. But modern OSes since NT times reallocate the whole file anew when it is written again. That means if you open an document and change it and write it again, it shows up elsewhere on the disk as a consecutive list of blocks.

The whole "its unix and therefore magical" thing makes really good marketing material, but isnt based in anything resembling reality.
No one said anything about magic. Point is, a 20 year old unix system is a fast as it was when it got installed. A 20 year old windows system won't even boot due to y2k bugs. And a 10 year old windows system is: for what ever reason unusable now.

No idea why you want to blame that on "bad drivers" etc. when that is obviously an inherent problem of the platform.

Comment Re:Oh noes .. Reality field collapses .. arrghh (Score 1) 172

by angel'o'sphere (#48047791) Attached to: New OS X Backdoor Malware Roping Macs Into Botnet

I would say most macs can run untrusted software.
First of all plenty of users are still in 10.6.xx and further more every "power" user changes the settings. As it is super annoying to be asked every time if you want to start this "untrusted application". For some reason there is no: "never ask again for this app" option.

Comment Re:Doesn't work for everyone (Score 1) 81

by quantaman (#48047639) Attached to: Xen Cloud Fix Shows the Right Way To Patch Open-Source Flaws

So unless you lived under a rock, most people knew there was a security bug out there (why else would the big cloud providers be forcing a restart of all my VMs?) We didn't know what it was, and because I'm not part of the preferred client group my servers didn't get patched prior to disclosure. So for me, no this isn't sufficient. I prefer the more open way of doing it, versus fixing it in a closed "preferred client" way that they handled this.

What more open way do you propose?

With this approach the major vendors got patched first, while you and the attackers both got some forewarning that a vulnerability and patch were going to be made available and got to find out about both at the same time.

In a more open system the only real difference seems to be the major vendors would end up in the same boat as you, having to race the attackers to apply the patch. It removes a comparative advantage they have but seems to make users less secure in general. Maybe the disclosure list could be larger but I'm not sure of a system that allows all of the users to be patched before any of the attackers find out about the exploit.

Submission + - Lost Opportunity? Windows 10 Has The Same Minimum PC Requirements As Vista (hothardware.com) 1

Submitted by MojoKid
MojoKid writes: Buried in the details of Microsoft's technical preview for Windows 10 is a bit of a footnote concerning the operating system's requirements. Windows 10 will have exactly the same requirements as Windows 8.1, which had the same requirements as Windows 8, which stuck to Windows 7 specs, which was the same as Windows Vista. At this point, it's something we take for granted with future Windows release. As the years roll by, you can't help wondering what we're actually giving up in exchange for holding the minimum system spec at a single-core 1GHz, 32-bit chip with just 1GB of RAM. The average smartphone is more powerful than this these days. For decades, the standard argument has been that Microsoft had to continue supporting ancient operating systems and old configurations, ignoring the fact that the company did its most cutting-edge work when it was willing to kill off its previous products in fairly short order. what would Windows look like if Microsoft at least mandated a dual-core product? What if DX10 — a feature set that virtually every video card today supports, according to Valve's Steam Hardware Survey, became the minimum standard, at least on the x86 side of the equation? How much better might the final product be if Microsoft put less effort into validating ancient hardware and kicked those specs upwards, just a notch or two?
Intel

Intel Drops Gamasutra Sponsorship Over Controversial Editorials 724

Posted by timothy from the middle-of-the-road dept.
An anonymous reader writes Processor firm Intel has withdrawn its advertising from Gamasutra in response to the site's decision to carry feminist articles. The articles had drawn the ire of the self-described "Gater" movement, a grass-roots campaign to discredit prominent female games journalists. Intel was apparently so inundated with criticism for sponsoring the Gamasutra site that it had no choice but to withdraw support. An Intel spokesperson explained that "We take feedback from our customers very seriously especially as it relates to contextually relevant content and placements" and as such Gamasutra was no longer an appropriate venue for their products."

Submission + - Is it still worth grandfathering on Verizon's Unlimited data plan?

Submitted by Anonymous Coward
An anonymous reader writes: I understand a lot of people dislike Verizon in general, but assuming for a moment that they were your only option for a cellular service provider, is staying on their grandfathered unlimited data plan still worth it? Their recent announcement to not throttle traffic is inpiring, but I just don't know the long-term benefits of staying on this plan. I fear there is a tipping point where enough people will swap over to a metered plan and Verizon will ultimately abandon the unlimited altogether and assume the risk of losing a percentage of those remaining folks, at which point all of us who bought unsubsidized phones will have wasted the money doing so. Does anyone have any insight on this?

Submission + - MIT Thinks It Has Discovered the 'Perfect' Solar Cell (vice.com)

Submitted by Daniel_Stuckey
Daniel_Stuckey writes: A new MIT study offers a way out of one of solar power's most vexing problems: the matter of efficiency, and the bare fact that much of the available sunlight in solar power schemes is wasted. The researchers appear to have found the key to perfect solar energy conversion efficiency—or at least something approaching it. It's a new material that can accept light from an very large number of angles and can withstand the very high temperatures needed for a maximally efficient scheme.

Conventional solar cells, the silicon-based sheets used in most consumer-level applications, are far from perfect. Light from the sun arrives here on Earth's surface in a wide variety of forms. These forms—wavelengths, properly—include the visible light that makes up our everyday reality, but also significant chunks of invisible (to us) ultraviolet and infrared light. The current standard for solar cells targets mostly just a set range of visible light.

Comment Re:Maybe? (Score 1) 81

by quantaman (#48047327) Attached to: Xen Cloud Fix Shows the Right Way To Patch Open-Source Flaws

I mean, some open source projects don't actually have anyone doing live support and a patch happens when someone "gets around to it".

True but a delayed publication of the bug isn't really going to affect them.

And some exploits are out there whether you say anything or not. Slashdot users pretty regularly complain about this with bumper sticker wisdom about "security through obscurity".

I'm not sure that specific complaint is that common. Certainly if a project sits on a security bug for months, or even years, then the security through obscurity criticism is valid. But the vast majority seem to feel it's alright to wait a couple weeks to get a patch together and inform the major users, that seems to be the fastest way to protect the most people as quickly as possible.

And just because the deployments are all fixed, doesn't mean someone has used that. Heartbleed(cited in the summary) was fixable within a couple days on every major linux distro with a simple update. That didn't mean no one got hacked.

All-in-all, sure it's a good policy, but not the magic perfect, oh-lets-all-be-like-xen thing the summary makes it out to be.

AFAIK Heartbleed was fixed before the disclosure, but the multiple discoveries caused OpenSSL to push up the disclosure timeline so not every distro had time to get a patch together.

On the contrary I think Shellshock was bungled a bit, I can't find a firm timeline of who discovered what when but the bug went public before there was even a working patch, much less one pushed out to the major distros. It was definitely the wrong way to do things.
Security

Building a Honeypot To Observe Shellshock Attacks In the Real World 41

Posted by timothy from the distract-them-with-fresh-targets dept.
Nerval's Lobster writes A look at some of the Shellshock-related reports from the past week makes it seem as if attackers are flooding networks with cyberattacks targeting the vulnerability in Bash that was disclosed last week. While the attackers haven't wholesale adopted the flaw, there have been quite a few attacks—but the reality is that attackers are treating the flaw as just one of many methods available in their tool kits. One way to get a front-row seat of what the attacks look like is to set up a honeypot. Luckily, threat intelligence firm ThreatStream released ShockPot, a version of its honeypot software with a specific flag, "is_shellshock," that captures attempts to trigger the Bash vulnerability. Setting up ShockPot on a Linux server from cloud host Linode.com is a snap. Since attackers are systematically scanning all available addresses in the IPv4 space, it's just a matter of time before someone finds a particular ShockPot machine. And that was definitely the case, as a honeypot set up by a Dice (yes, yes, we know) tech writer captured a total of seven Shellshock attack attempts out of 123 total attacks. On one hand, that's a lot for a machine no one knows anything about; on the other, it indicates that attackers haven't wholesale dumped other methods in favor of going after this particular bug. PHP was the most common attack method observed on this honeypot, with various attempts to trigger vulnerabilities in popular PHP applications and to execute malicious PHP scripts.

Submission + - Building a Honeypot to Observe Shellshock Attacks in the Real World (dice.com)

Submitted by Nerval's Lobster
Nerval's Lobster writes: A look at some of the Shellshock-related reports from the past week makes it seem as if attackers are flooding networks with cyberattacks targeting the vulnerability in Bash that was disclosed last week. While the attackers haven’t wholesale adopted the flaw, there have been quite a few attacks—but the reality is that attackers are treating the flaw as just one of many methods available in their tool kits. One way to get a front-row seat of what the attacks look like is to set up a honeypot. Luckily, threat intelligence firm ThreatStream released ShockPot, a version of its honeypot software with a specific flag, “is_shellshock,” that captures attempts to trigger the Bash vulnerability. Setting up ShockPot on a Linux server from cloud host Linode.com is a snap. Since attackers are systematically scanning all available addresses in the IPv4 space, it’s just a matter of time before someone finds a particular ShockPot machine. And that was definitely the case, as a honeypot set up by a Dice (yes, yes, we know) tech writer captured a total of seven Shellshock attack attempts out of 123 total attacks. On one hand, that’s a lot for a machine no one knows anything about; on the other, it indicates that attackers haven’t wholesale dumped other methods in favor of going after this particular bug. PHP was the most common attack method observed on this honeypot, with various attempts to trigger vulnerabilities in popular PHP applications and to execute malicious PHP scripts.

Submission + - Intel drops sponsorship of Gamasutra in response to feminist articles

Submitted by Anonymous Coward
An anonymous reader writes: Processor firm Intel has withdrawn its advertising from Gamasutra in response to the site's decision to carry feminist articles. The articles had drawn the ire of the self-described "Gater" movement, a grass-roots campaign to discredit prominent female games journalists. Intel was apparently so inundated with criticism for sponsoring the Gamasutra site that it had no choice but to withdraw support. An Intel spokesperson explained that "We take feedback from our customers very seriously especially as it relates to contextually relevant content and placements" and as such Gamasutra was no longer an appropriate venue for their products.

Submission + - Hacking USB firmware

Submitted by Anonymous Coward
An anonymous reader writes: Now the NSA isn't the only one who can hack your USB firmware:

In a talk at the Derbycon hacker conference in Louisville, Kentucky last week, researchers Adam Caudill and Brandon Wilson showed that they’ve reverse engineered the same USB firmware as Nohl’s SR Labs, reproducing some of Nohl’s BadUSB tricks. And unlike Nohl, the hacker pair has also published the code for those attacks on Github, raising the stakes for USB makers to either fix the problem or leave hundreds of millions of users vulnerable.

Personally, I always thought it was insane that USB drives don't come with physical write-protect switches to keep them from being infected by malware.

Slashdot Top Deals

Happiness is twin floppies.

Close