Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
×

Comment NVD link (Score 1) 45

https://web.nvd.nist.gov/view/...

The debug console interface on Cisco Small Business SPA300 and SPA500 phones does not properly perform authentication, which allows local users to execute arbitrary debug-shell commands, or read or modify data in memory or a filesystem, via direct access to this interface, aka Bug ID CSCun77435.

Impact

CVSS Severity (version 2.0):
CVSS v2 Base Score: 6.9 (MEDIUM) (AV:L/AC:M/Au:N/C:C/I:C/A:C) (legend)
Impact Subscore: 10.0
Exploitability Subscore: 3.4

CVSS Version 2 Metrics:
Access Vector: Locally exploitable
Access Complexity: Medium
Authentication: Not required to exploit
Impact Type: Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service

Comment Re:What's missing from this story? (Score 3, Interesting) 569

Why do Americans automatically accept that kicking the door down and holding everyone at gunpoint is a reasonable response to an anonymous 911 call?

Yes. This is the question that no one asks. Why we tolerate a culture in which police are empowered to kick in doors all the time.

a) Hollywood/media makes guns glamorous
b) it doesn't affect us personally (until it does)
c) there are other issues that are affecting us
d) our leaders have no interest in the matter (with rare exception).
e) out political system is broken

basically, the status quo is really difficult to change because it's controlled by groups of people that only change when members of them die.

Comment Re:And now, by extension ... (Score 1) 107

And now I believe the black hat hackers should more or less just go scorched earth.

If there's no system left, there's no evidence. Just burn it on your way out.

i feel the same way but for a different reason: if there are no insecure systems left standing, only secure systems will be able to stand. in effect, security by destruction of the insecure. a sharp learning curve but companies will start making secure products that way.

Comment Re:not just unlikely, completely avoidable. (Score 1) 70

pff... try taking your meds. when parts of the internet go down, people notice. remember syria when the NSA actually did brick routers there? yeah, that made headlines. after finding out what the US gov has been up to, people have become much more interested in the cause of outages. if the military gets caught doing something like that on the american public, there will be pitchforks and torches making an appearance.

Comment not just unlikely, completely avoidable. (Score 2) 70

a cyber armageddon is super easy to avoid, all you have to do is not connect every damn machine to a network and for the ones that must be, secure them. it's quite obvious that we have the capability to find and exploit weaknesses, so why not use our knowledge and secure those few things that must be connected. we could also be prudent and require (by law) a certain level of software security for dangerous things connected to the internet (if stupid people insist on having them connected). finally, it sure wouldn't hurt if we started teaching things like how to mathematically prove a buffer wont overflow.

Comment Re:Underlying problem (Score 1) 130

And here is the underlying problem with a good chunk of FCC regulation.
Basically, you can do anything you want until they decide it is against an arbitrary regulation. Then they can not only stop you from doing it, but fine you for having done it.

i call bullshit.

Think of the "decency" statues for broadcast TV. Sometimes you can swear (playing Saving Private Ryan) sometimes you can't (some random award show) Sometimes you can show nudity (NYPD Blue) sometimes you can't (Superbowl?) The FCC will let you know you violated the unspecified rules via a fine
well after the fact.

guess what, they have very detailed rules on decency and guess what, it actually makes sense. what is required to be censored is based on context! what context? well, the rating of the show, time it's broadcast and if it's a public broadcast or not and some other things that are well documented. fun fact, if you don't know if what you are going to show will violate the rules, you can ask them!

This is the regulatory regime being imposed on the business practices of ISPs.

the rules they have put forth are exceptionally simple. all they have to do is not limit the speed of the connection based on the connection endpoint. seriously, that's it! they can restrict your speed out the wazoo based on any criteria except the endpoint. want to slow down HTTP traffic? you can do that! however, you can't make it faster for XYZ because XYZ gave you money.

I don't like the big ISPs screwing around with the internet just as most anyone else, but this type of regulation is bonkers.

i'll take "bonkers" regulation over blatant abuse any day. then again, maybe you just haven't read all 300 pages, so you dont really know facts.

Comment Re:What if the leader/decision maker is incompeten (Score 1) 255

how to address technically competent people who make nonsensical decisions.

for people who are completely hardened and unwilling to even consider the possibility that they are wrong, there is nothing you can do besides fork the code and go on. however, people may not be hardened like you think so in the case of UI choices, a usability study could be performed. it will require significant effort but it may change some minds. the question you must then contend with is if it's easier to fork or is it worth the effort to run a study. the windows 10 preview was effectively a study on how usable their UI was.

Slashdot Top Deals

Without life, Biology itself would be impossible.

Working...