Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
×

Comment Killer features? (Score 3, Interesting) 88

Here's the tricky thing about privacy and social networks: Facebook's privacy support is actually pretty good. Whilst people might tell you in the abstract that they want more privacy from Facebook, figuring out what they would change in concrete terms is very hard. For example, they might say "I don't want to see ads" - but given the choice, they don't want to pay for anything either. So this feedback ends up being pretty useless, equivalent to hearing "I want everything and a pony". It's not a basis for a product.

Google learned this one the hard way with Google+. The original way Google+ tried to differentiate itself from Facebook was with circles. The idea is, Facebooks relatively singular notion of "friend" doesn't reflect the way real people work, this means it doesn't respect people's privacy and so people use the product less .... therefore by giving them better tools, they'd win a lot of users. Facebook responded that they'd tried the same thing, it turns out people don't like making lists of friends and controlling their sharing at a fine grained level, so it wouldn't work. And guess what? Facebook were right. Sure, you interview people in focus groups and they say one thing. In reality they might do something else.

So - decentralised open source social networks. Not gonna work. People might sound enthusiastic when you pitch it to them in the abstract, but actually Facebook works fine for them, and the kind of privacy that matters to them (can people see who views their profile?! Can my parents see my drunken party pics?) is already well supported and tuned.

Ultimately what will do off Facebook, eventually, is a change in how people use social networking that for whatever reason they cannot replicate in their main product.

Comment Re:And this is why... (Score 1) 183

I think you know this but sometimes it's a bit hard to read tone on the internet.

HSBC processed transactions for Iran in Europe, at a time when the USA had not successfully forced Iranian sanctions onto the EU and thus they were entirely legal.

The USA did not like this one bit, because Congress had a 'fuck Iran at any cost' mentality that extended to trying to make US sanctions global. And one way they did that is by prosecuting or threatening to prosecute American employees of international banks for transactions entirely legal in both the source and destination locations. It's just empire, nothing more.

Comment Re:It's not only SSL/TLS (Score 1) 92

That's not "lack of diligence", that's a fundamental bootstrapping problem. CA's are meant to verify identities. If the identity you are trying to verify is not itself cryptographically verifiable, then the attempt to verify can be tampered with, but the only way to solve that is to use harder to verify identities. Which is what EV certs do, and my own experience of getting one was pretty smooth.

Comment Re:It's an encryption layer (Score 1) 92

You might think I'm exaggerating, but even major corporations fuck this up all of the time. There is no "just choose sensible defaults and give me a secure socket" call, because if there were someone would complain that it's not secure and shouldn't be used.

Sure there is. Perhaps not in C but what did you expect? Here we go in Java:


HttpsUrlConnection conn = (HttpsUrlConnection) new URL("https://www.google.com/").openConnection();
Certificate[] certs = conn.getServerCertificates();
InputStream stream = conn.getInputStream(); // read stream here ....

That'll do the right thing by default.

SSL is imperfect, but that's because crypto is hard, not because of some fundamental fuckup somewhere and if only we all used the alternative protocols (which?) everything would be peachy.

Comment Re:Which 6? (Score 1) 107

Yes, but exploited browser rendering engines have been a large source of infections too. Sandboxing mobile code is just really hard. However the web is indispensable whereas Java applets aren't, so Java is the one that gets thrown out.

I suspect there isn't any way to build support for Java applets that satisfies Google's policies, therefore, they will end up being restricted to other browsers for the small number of people who need them (mostly enterprise apps).

These days the Java sandbox is actually a lot better than it used to be. Last I heard there had been no zero days this year at all. However, the Java update story still sucks, and Sun/Oracle have made Java supremely unpopular on Windows thanks to the crappy update nags and bundled adware. So nobody will be sad to see it go. Java is moving to JRE bundling for distributed apps anyway: I've written one with the new tools and it basically works like a regular desktop app, with a native installer / package on each major platform.

Comment Re:Waiting... (Score 1) 144

OK, here's a site with an interview with IDEO's designer. It has the key pictures without the UI from hell.

This is the Eric Schmidt vision of the future. People will still go to offices and have meetings. They'll just have better cars and presentation tools, and better delivery services for physical stuff.

Will we really need that many office workers? That's the huge question. Given the head counts at newer companies, probably not.

Comment Waiting... (Score 1) 144

3% loading...
Page with 3 icons loads. Click on first icon. Background sound loop of birds chirping with wihite noise and gap at the end of the loop starts. That's all that happens.

Firefox 33 on Ubuntu reports: Media resource http://automobility.ideo.com/a... could not be decoded. automobility.ideo.com
TypeError: e[0].play is not a function main.js:1
TypeError: e[0].pause is not a function main.js:1

Don't they test their code?

Comment When cars are self-driving and shared (Score 1) 454

...they'll all be owned by Uber.

There's a network effect for shared vehicles. Availablility is best if you have one big pool of cars rather than lots of little ones. So there will be a single winner in that space for each city.

Imagine Uber having the power of GM and Google combined. Run by the current team of assholes.

Comment Re:Police legal authority (Score 1) 165

I know, the stingray is essentially a hacking tool. That makes you think though, why on earth is there a large wireless network carrying sensitive data without TLS (transport layer security), or encryption between the modem on the phone, and the carrier? Either the contents are not sensitive, or the carriers / cell phone manufactures are complicit or worse.. incompetent.

GSM dates to 1987. When it was created, the previous mobile telephony standard was analogue - you could listen in on calls just with a regular radio. There was a very small amount of digital signalling to the network, but the field of commercial crypto hardly existed back then and subscriber cloning/piracy was rampant. GSM introduced call encryption and authentication of the handset using (for the time) strong cryptographic techniques. It was very advanced. But it didn't involve authentication of the cell tower to the handset, partly for cost and complexity reasons and partly because a GSM base station involved enormous piles of very expensive, complex equipment that had to be sited and configured by trained engineers. The idea of a local police department owning a portable, unlicensed tower emulator was unthinkable, as the technology to do it didn't exist, and besides .... trust in institutions has fallen over time. Back then it probably didn't seem very likely police would do this because they could always just get a warrant or court order to turn over data instead.

When 3G was standardised, this flaw in the protocol was fixed. UMTS+ all require the tower to prove to the handset that it's actually owned by the network. Little is publicly known about how exactly Stingray devices work but it seems likely that it involves jamming 3G frequencies in the area to force handsets to fall back to GSM, which allows tower emulation.

The latest rumours are that the company that makes Stingrays has somehow found a way to build a version that works on 3G+ networks too called "Hailstorm", but it's dramatically more expensive and as mobile networks phase out GSM in the coming years police departments are having to pay large sums of money to upgrade. The whole thing is covered in enormous secrecy of course so it's unknown how Hailstorm devices are able to beat the tower authentication protocol. Presumably the device is either exploiting baseband bugs, or is using stolen/hacked/court-order extracted network keys, or it was built in cooperation with the mobile networks, or there are cryptographic weaknesses in the protocols themselves.

Slashdot Top Deals

An Ada exception is when a routine gets in trouble and says 'Beam me up, Scotty'.

Working...