Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
×

Comment Re:Just Installed it. (Score 2) 254

Cool. "Therefore, more complex ranking algorithms such as those used by Google (which analyze rank using a variety of contextual factors developed during webspidering) are not available in YaCy, placing severe limits on most users' means to retrieve the results they seek. For instance, none of the top 10 results returned by YaCy's public search when queried "Google" actually refer to Google's homepage."

Comment TFA! Read it! (Score 3, Informative) 249

Then linked from the original article is the study is basing it on. http://code.google.com/speed/webp/docs/webp_lossless_alpha_study.html
It's essentially saying that nearly the entire reason it's a fraction smaller in lossless mode is because there's no alpha support. Combining it the "optional" alpha mode with the "optional" lossless mode merely makes it near-identical in size to PNG, according to them.

The more features you take out, and the more you degrade the pictures, the smaller they are in comparison to the original. Is this somehow surprising?

Comment It's about time... (Score 4, Informative) 237

It's about time Slashdot stops accepting 'blogspam' links, such as Phoronix, instead of attributing the actual source itself. Phoronix didn't solve this, a developer did.
A badly written Slash summary (and 'article') which just links twice to the same braindead Phoronix article (which itself is a several day old duplicate) is bad. Very bad.

Dredged from the bottom of Phoronix:
Mailing list post: http://lists.fedoraproject.org/pipermail/devel/2011-November/158976.html
Fedora 17 feature point: https://fedoraproject.org/wiki/Features/Gnome_shell_software_rendering

Personally, I have little doubt that the "anonymous reader" is Michael Larabel himself.

Comment Re:Nothing to see.. (Score 4, Informative) 194

It can add itself to your user files, which allow something to start "at boot", as long as that user is the one (auto)logging in.

You don't see much Windows malware adding itself to your "Startup" folder, but few average Mac users are going to check "command line files" to see whether something has injected something bad or not.

As TFA says, this isn't a PDF, but an executable merely pretending to be one.

It's a trojan, and it likely wouldn't even be sandboxed due to the ball-dropping there on Apple's part. It wouldn't be able to snoop some low level processes, but absolutely anything that is running under your user? Yup. Open ports to communicate with the mothership? Of course. Install a line to start whenever this user is logged in? Of course.

If you get a user dumb enough to allow admin privileges to a fake PDF, you can use officially sanctioned mechanisms to inject code into every process in the machine without requiring a separate 'trojan process' to stay alive to monitor it. Or just replace the operating system kernel. :p

Comment Re:Them new DE's, man (Score 1) 468

It's a bit of a daft argument to begin with, that programmers (especially linux programmers) shouldn't have to be making.

"We don't expect you'll care about the choice. We arbitrarily believe most people like this, and will most likely continue to prefer it until at least 2050. We're effectively removing the choice by not putting 5 lines of configuration code in to read it as a value instead of hard coding it."

If it's a simple option, especially one of user choice and customization, especially something simple...it makes no sense to hardcode the value, or automatically assume it has to be that way, instead of being able to support at minimum the basic things users want to do with their software.

On Linux, rather than choice within an app, the choice often comes between separate programs that mostly do the same things, but have different defaults or fixed values. The natural choice, when available, becomes the most flexible thing that still does what you actually want it to do.

Comment Re:Route This Tomato! (Score 1) 207

Wow, that comes off as angry, snarky, and generally trollish for putting words in my mouth. Where did I say anything about 'turn off all ICMP'?

Windows uses ICMP for traceroute, Linux uses UDP packets, a few separate utilities use TCP. None of which trace very far with that disabled and active iptables firewall on the router. It disables echo, maybe traceroute, not ICMP in general. Using a variety of ICMP, UDP, and TCP online tools (I don't have a handy unix shell available right now, try again tomorrow), tracing to my public IP, with it allowed gets everything right quickly. Switch that one thing off, not one of the traces completes, some trace to completely different IPs and 'fall off'. All take a long time (1 to 25 minutes).

Can I get other, useful ICMP types? Yes. Do I have any reliability, latency, or speed issues with ICMP, TCP, or UDP, of any variety whatsoever? No.
The only other ICMP message which security implications (as far as I'm aware) is redirect, which is scarcely used for anything good anymore, at least on residential ISPs. Some ISPs block ICMP echo altogether upstream due to worms of the past using it as a popular technique (and congesting everything to hell).
Other than that, for IPV4, aren't only Unreachable and Time Exceeded generally used anymore for actual usage? Probably won't get "Header Parameter Problem" unless you're experimenting with the IP stack itself.
I don't know -as- much about ICMPv6, but it looks like there are 4 useful error messages, and 7 useful information messages, not counting echo; it's useful for infrastructure and servers to have echo on, not for home users who don't need to be pinged directly to see if they are alive.

DoS attacks are illegal, very obvious, and ISPs don't like it. I don't know what brought on THAT comment. I'm not particularly concerned about that, because I can be pretty sure they won't be getting access to my information if they're flooding theirs, and that tends to get law enforcement involved really quickly. If somebody keeps my piddly little desktop offline for a day, they get to go to jail. Even if my ISP might possibly be too dumb to filter it at the edge of the network (or at the source if in-network)... jail for them, a mild inconvenience for me. Somehow, I'm okay with somebody that stupid not being my problem.

Google collected a lot of data. It's beyond inane to assume they couldn't (or wouldn't) have obtained other details, when -I- can do so with a commodity bargain router and a few utilities (all of which can run on the router itself and don't involve 'breaking' or accessing anything, just passively listening). On open networks, everything's transmitted in the clear. YOU don't have to log in, if you can watch somebody else do so. I don't think Google cares that much, and isn't that nefarious. But it's purely naive to assume that just because Google got away with it, others aren't interested in information you transmit.

This is frigging Slashdot, isn't it common knowledge to secure your data (as best as possible) over a completely untrusted, and insecure network, notoriously vulnerable to external snooping from anyone with a $5 USB plug and a computer from the last 10 years? It's not some kind of national security thing, but I don't exactly feel comfortable with a hotel manager (or someone in the neighborhood if I were dumb enough to run an unsecured router for my own use) reading my personal correspondence with relatives and friends. That's a very basic privacy and trust issue, not one of location finding. It's also common sense.

There are a number of proofs of concept (http://samy.pl/mapxss/ for instance) showing that you can use javascript to determine public MAC information, and street address, using Google's own tools, but not requiring any sort of 'privileged' access to anything whatsoever. More than one person I knew had been able to locate their exact street address because their router had at one time been broadcasting. That one doesn't use a public IP address, but the MAC address. Assuming anyone CAN get access to it (which the cross-site-scripting can do on some routers), then they have your approximate street address.

And nothing in TFA (maybe you've read it), or anything I ever said, requires Geolocation Services, or anything else 'special' to be enabled in a web browser. And, various popular and common web browsers default geolocation to on, and don't prompt, besides that.

If you turn geolocate off, turn echo and trace off unless you have an immediate need for it (then turn it off after), then you're probably considerably better off. Similar to having a firewall, and other basic security procedures in the first place. Isn't anti-virus on any OS (unix mailservers and OSX have them too) a reasonable thing to have if you don't want viruses, spyware, or trojans delivered to or through your systems? So why is this any different? You may voluntarily turn off something that has zero practical use on the internet but has well known security risk, and makes you more likely a target.

The technique described in the article (which is, as usual, light on technical details), appears to just use pingback/trace on connection and general latency measuring vs. other sources, to try to narrow down where you are progressively until it gets you within 100 meters. The problem comes when you can't reliably measure the latency from a host. Connections from a user to a host aren't that useful for that purpose (different outbound path to you, than you are to them) and can vary widely. So the only feasible thing you could use, is an outbound unsolicited connection (assuming no congestion anywhere, of course). If it's flat rejected, you might be able to work around it. If it's dropped, you have zero reliable information except their IP address and their ISP (which you could've found using whois on the IP much faster).

I'm sorry, Mister or Miss 'Pundit', but you were well off the mark on this one, and constructed a straw man argument with things I didn't say or suggest.
In the end, the whole issue of not wanting your street address able to be located, either by advertisers, or stalkers, is a simple privacy issue. No matter the method, are you suggesting that you want people to be able to trace your physical location because of a post you made, or snoop on your assumed-private data? Because that's what I've been talking about, and saying how Reasonably Achievable it is to STOP those two from common sources, and be able to test/verify it for yourself.

That's slightly technical in nature, I suppose, but I hardly think it's above the head of a Slashdot reader, or unreasonable in nature or content. What's next?

Comment Route This Tomato! (Score 1) 207

Well, my router has defaulted to NOT respond to pings in the default configuration for years. Finally, there's a good reason not to, but seriously, even the known TCP/UDP traceroutes require an open inbound port on both the end host, and the same(?) on every intermediate host.
There's no good reason to have ping (and hence traceroute) enabled.
You're far more likely to have your IP address and/or your MAC address located by street address via Google, because 'everyone' tends to have unsecured wifi now.
Ignoring the facts of fast GPU-driven encryption cracking for wifi purposes, don't use unsecured wifi, and don't use your real MAC address for wifi.
It seems like RFID, they ignored predictions on technology advancement, so now anyone with enough hard drive space (by far the limiting factor, last I checked) and a $5 wifi adapter can can crack any 'encrypted' wifi (except apparently RADIUS, maybe)., but spending a few hundred dollars, is 'easy' if you're interested in looking at everyone's stuff, whether for creepy personal motives or profit.
Another reason to only use SSL or SSL+tor when on wifi.

Comment Re:The will to be free (Score 1) 648

"Everybody" uses Ubuntu, then complains about the bugs Ubuntu has had for a long time, and doesn't seem to be much of an issue for any other distribution.
Perhaps diversity is a good thing, no matter how much Ubuntu tries to package and sell Unity (in more ways than two).

Hardware and software support is directly a function of the linux distribution, not because of availability 'in the wild', but which ones manage to screw up the good deal that's already happened worse than others.

You can have fine-tuned death machine of acid and fire that you jigsawed together and quite probably can't reproduce again later, or you can a nicely pre-packaged steaming pile that takes most of the useful stuff away, tries to prevent you from installing things it doesn't happen to like, and introduces bugs by using an excessive number of 'custom' patches and self-advertising branding to every possible application, library, and utility. To date, there haven't been many exceptions. Many...actually, are there any? Can't name any off-hand that are both powerful, flexible, and LSB/posix/upstream compliant, but also have nice easy-install easy-setup easy-everything. (Sabayon doesn't count, since it's pre-packaged unflexible Gentoo, hence without the Gentoo part.)

Comment Just what we need! (Score 2) 181

Bullet Proof Banana Hammocks Made Out of Bananas.

On a serious note, a lot of 'projects' seem to come out like this one, but very few ever seem to make it to commercial scale and distribution, let alone success and continued survival. "Alternative" tech never seems to sell, quite possibly because it's 'alternative', and the big boys have enough cash to make most things go away that would cut into their profits, like that pesky cold fusion.

Comment Re:It's a linux distro. (Score 1) 207

Speaking of pretentious...
If GNU/Linux is a "jail", and you have to "get out of jail" by only using non-free software...then perhaps I'll just use Linux Linux. Linux is just a kernel, and GNU tends to be nearly the worst toolchain/base tools on any OS. BSD base tools are at least clean, efficient, and actually follow the unix pholosophy, instead of building a private copy of "sort" into every command.

The "Libre" version of the kernel has gone so far (at least last year, when it was on lwn) as to 'forbid' you from running any kind of non-GPL drier or blob.

The LK itself wasn't even initially GPL, for a few versions. Linux, and other software, is available because people were free to choose to be able to do it and pursue it, not because the GNU foundation exists and heavily advertises its own worth. GNU also tends to 'frown' upon non-GPL, but otherwise 'more liberal' open source software because it allows more choice, and hence 'evil proprietary software can choose it too! bad! shame!' (I can imagine Stallman saying that out loud, that verbatim...I really can).

"I'm just doing a (free) operating system (just a hobby, it won't be big and professional like gnu) for 386(486) AT clones."
^ GNU would have a lot more credibility, if Hurd was an operating system people knew about as well as NetBSD...or even the L4/Fiasco Microkernel.
It's been in Development Hell since 1986. Their initial option was to use a 4.4BSD kernel (circa 1987) and rework it, but they weren't getting extensive bend-over-backwards do-it-for-us support from the Berkley guys, so wanted 'Mach' instead...waited 3 years for them to change the license for them...

The common factor about the "rejections" on the "Free Linux" thing, like for Debian, is that all a distribution has to do is offer the "option" to install non-free, even if it's disintegrated with the project, not 'easily available' in the software, or easily linked from websites or main pages, but that it's merely not-impossible to search for it on the internet, find it, and install it. Woo. "FreeBSD, NetBSD, and OpenBSD all include instructions for obtaining nonfree programs in their ports system."

If you can't trust *administrators* to make their own logical choices, even if 99% of their software is free, then you shouldn't be promoting Linux.
The GNU philosophy is, and always has been, a 'walled garden' of supposed luxury and extravagance that tends to fall short and piss people off because they're just taking choices, options, and 'stuff' away from you.
The lovely thing is, it appears to predate the Apple notion of that by at least two decades. ... I wonder if that's where Apple got the idea.

But it's very classic Soviet style/Stalinist, to talk about "the freedom of the people", while ordering them by threat of death not to think of anything on the non-approved list.

I'm always going to run proprietary stuff, because I like my video card to operate, I like OpenCL, I like video playback. The 'license restrictions' per-distro, tends to mean at least one of those is not available via 'normal' means.

And as various Linux foundations and organizations have done, encouraging developers, and "scary proprietary people" to release their program/utility/game/driver source code under a free license, eventually, is easier by making them -like- Linux, instead of feel threatened by it.
If it's turned into religious dogma (which Stallman seems rather proud of), then you're going to have at least two diametrically opposed camps who will never get along, and will essentially try to "kill" each other over time.

I've always found it amusing that the "linux" community seems to think itself much superior to and isolated from their *BSD second-cousins, but what people should perhaps be more worried about, are all of the greedy corporations, and corporate takeovers, that threaten decently sane and objective policy making. Fedora at least got 'spun off' from Redhat, and they for the most part, haven't been trying to burn anything down. You can't say that for Canonical, Mandriva's group, or (unfortunately, now) Novell. Probably not either for the others that I can't think of off-hand this early in the morning.

That kind of corporate meddling has got an entire toolkit/desktop environment (GTK+GNOME) making drastic, bizarre usability decisions, mostly based on one company's money.
All of these GNU-activist people seem to be worried about 'proprietary software', when 'proprietary money used to drive primary development focus on free projects' tends to be more stagnating and crippling, if it's causing real bugs, feature requests, existing projects, and roadmaps, to get ignored because they're not getting paid 'extra' for it.

Qt is largely a Nokia effort, but, they have to worry about their product bottom line, so it's in their best interest to make things as best, and as pleasing as possible to all end users and developers.
Corps like Canonical sell services, and derived packages. They don't have to care about what people want in a UI (and frankly have said they don't give a shit, in so many words), or performance, or usability, or general practical sanity, but they might care about what's easiest and most consistent to "develop" for, even if they end up making it only usable by psychic armless children from Belarus. People will still buy it because of the 'brand' name. I wonder where I've heard that story before...

Meh...we'd all be better served if (software) engineers would reasonably (when productive/valid/sane to) stick to engineering, instead of politics, philosophy, or quasi-religion.
Guys ranting a political agenda while trying to push their 'special' software at you, was barely tenable in the 1980s, and it's very simply counterproductive and offputting in the 2010s; much for the same reasons less and less people are willing to put up some faceless third party saying that they're going to be punished if they don't slaughter a cow to appease the sky this weekend (or anything else that absurdist and irrelevant).

Comment Et Tu, Machina? (Score 1) 203

"I don't need to use the phone, so I am looking for an unlocked phone"
Well, there's your problem right there.

Also, the android SDK has emulators for all of their phone API levels. If you're planning to get a phone, "but not a phone", it would obviously be cheaper to use that, especially if you aren't planning to use any sort of advanced features (like for 'flash'). You could then just ask someone you know to test things on their phone to make sure it looks like what you see on the SDK.

Otherwise, if you're looking for a phone...that can make phone calls, I hear that Android and iPhone are actually pretty bad at it!

Slashdot Top Deals

Doubt is a pain too lonely to know that faith is his twin brother. - Kahlil Gibran

Working...