Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×

Comment Re:Wat? (Score 1) 582

You seriously think that black hats bother with reading millions of lines of code in the hope of finding an exploit when all they have to do is play with the data sent to services/applications and see if it misbehaves. Which is why exploits are equally found among closed and open softwares.

Generally I still think that open source projects have an advantage over closed source because there are more eyes on the code in a FOSS project. That being said shit does and will happen and unfortunately even in open source projects sometimes a whole lot of shit manages to pile up before it finally hits the fan which of course then results in a particularly big and very stinky mess like Heartbleed. What the OpenSSL team seems to have failed to do is to perform a really serious amount of destructive testing on their library which, as you pointed out is essentially what black hats do to find these kinds of vulnerabilities anyway. This is not surprising since quality assurance and testing seems to be a bit of a poor relations many FOSS projects just like it is in the closed source community. Another thing I'd try if I was a black hat is to run some kind of static code analyser on the codebase that can identify this kind of problem so that might be another thing the OpenSSL team can try if they aren't doing it already. Finally, when something is as widely used and fundamental to the workings of the internet and online commerce as OpenSSL is one would expect that perhaps some of the big beneficiaries of the OpenSSL project like Google, Apple, Amazon, Facebook etc. could foot the bill to do some suitably paranoid amount of quality assurance on it and other such FOSS projects. After all it's not like any of them is short of cash now is it and maybe these corporations could invest some of that cash they avoid paying in taxes to make everybody's digital lives a little safer by offering bounties for OpenSSL bugs? (...and yes, I know that expecting corporations to show communal responsibility is a long shot but hope springs eternal)

Comment Re:Criticizing behavior takes time (Score 1) 575

Video games are trivial to get published.

It really depends on the genre because the more locked-down platforms handle some genres better than PCs. Party games, fighting games, and cooperative platformers really need two to four players holding gamepads and looking at one screen. A PC can technically do those, but in practice, desktop or laptop PC's monitor isn't big enough for more than one person, and I'm told few people are aware that they can use virtually any HDTV as a PC monitor. The touch screen that ships with a mobile device makes certain genres hard to control as well, as I discovered when I repeatedly failed to make a certain jump in the demo of Pixeline and the Jungle Treasure on my first-generation Nexus 7 tablet.

ObMicrosoft: Look at the drama surrounding updates to Fez .

Comment Two presses per letter (Score 1) 276

Some people might think "firstpost.com" is a troll site like "hotgrits.org" or anything in the .cx top-level domain. So let me explain this input method in my own words. It works in much the same way that activating tiny hyperlinks in the Chrome browser for Android works. Tap once in the vicinity of the key you want to press, and it'll zoom in on an area of the keyboard centered on where you pressed. Tap again to actually enter a letter.

Comment Re:Wow what idiots....can you make it more confusi (Score 1) 575

And the .NET updaters seem to take a lot more time than regular patches.

That's because the .NET Framework is rebuilding the "assembly cache" (recompiling the runtime library into the processor's assembly language) after an update. In a comment to a Slashdot story a few days ago, I suggested doing this rebuilding in the background, letting the user use native applications in the meantime, and marking managed applications that aren't yet ready to start with an hourglass icon. But another Slashdot user objected that letting the user run anything before the assembly cache finishes would break native applications that start a managed subprocess without user interaction.

How badly do you have to fuck up a language runtime library to make it need monthly updates?

The JavaScript runtime (Firefox or Chrome) needs updates as well. And on Ubuntu, I get plenty of updates to various libraries.

Comment Buy a certificate to retrieve your core dumps (Score 1) 575

but would it kill them to stick a "details" button on the dumbed-down error popup to make it trivial for a techie to ask the user to click it and read out a more useful message?

Microsoft would probably do it the way it does crash reporting, where the user is given the option to automatically send error reports to Microsoft. The developer can retrieve these crash reports by 1. forming a corporation or LLC, 2. buying a certificate from VeriSign or DigiCert in this company's name, and 3. registering with Windows Dev Center Hardware and Desktop Dashboard (formerly Winqual).

Comment Port to GCC, then ensure no backdoors in GCC (Score 5, Interesting) 171

One way to detect a backdoored compiler to a fairly high certainty is diverse double-compiling, a method described by David A. Wheeler that bootstraps a compiler's source code through several other compilers. For example, GCC compiled with (GCC compiled with Visual Studio) should be bit for bit identical to GCC compiled with (GCC compiled with Clang) and to GCC compiled with (GCC compiled with Intel's compiler). But this works only if the compiler's source code is available. So to thwart allegations of a backdoor in Visual Studio, perhaps a better choice is to improve MinGW (GCC for Windows) or Clang for Windows to where it can compile a working copy of TrueCrypt.

Comment Re:What if we overcorrect? (Score 5, Insightful) 343

Some people still try to debate things that are already settled and others look for solutions before everything becomes a problem. Mankind has a huge list of fuckups to fix - but we either continue as is or we continue to try to improve things. Your viewpoint is incredibly pessimistic. Very few people would say life was better 200 years ago than it is today. Let's take that viewpoint and move forward with it.. We need more Star Trek and less Water World.

Either way, we should be investigating options like these.. You're being pessimistic during the initial stages of discussion - so it brings very little to the table.

Comment Adding yet another box (Score 1) 433

You can use a small box like an Apple TV, which has a 6W power supply, or something like an Xbox 360 or Playstation 3 and use from 10 to 20 times more power for absolutely no reason.

If you happen to already own the Xbox 360 or PlayStation 3 console, how much energy does it take to manufacture and ship an Apple TV box and an automatic HDMI switch box?

Slashdot Top Deals

He has not acquired a fortune; the fortune has acquired him. -- Bion

Working...