Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×

Comment Re:Encryption (Score 1) 220

How do you explain to the user well their data might be encrypted yet their data is not protected since it is not trusted?

I'm talking about http here, not https. The idea is that even with http -- where you don't pretend that anything is secure -- you still encrypt everything. It's far from perfect, but it beats plaintext because the attacker can't hide anymore -- it has to be an active attack. I don't pretend to know all about the pros and cons of http 2, but plaintext has to die.

Comment Re:Encryption (Score 5, Insightful) 220

Nothing is NSA-proof, therefore we should just scrap TLS and transmit everything in plaintext, right? The whole point here is not to make the system undefeatable, just to increase the cost of breaking it, just like your door lock isn't perfect, but still useful. If HTTP was always encrypted, even with no authentication, it would require the NSA to man-in-the-middle every single connection if it wants to keep its pervasive monitoring. This would not only make the cost skyrocket, but also make it trivial to detect.

Comment Re:Encryption (Score 5, Informative) 220

A server cannot ask for encryption.

AFAIK, HTTP2 allows the server to encrypt even if the client didn't want to.

Unless the client establishes a secure connection in the first place, the server has no way of knowing if the client is actually who they claim to be. If the client attempts to establish a secure connection and the server responds with "I can't give you a secure connection" then the client needs to assume there is a man in the middle attack going on and refuse to communicate with the server.

If you're able to modify packets in transit (i.e. Man in the Middle), then you can also just decrypt with your key and re-encrypt with the client key. Without authentication, there's just nothing that's going to prevent a MitM attack. Despite that, being vulnerable to MitM is much better than being vulnerable to any sort of passive listening.

Comment Re:Encryption (Score 4, Informative) 220

Last I heard, it still supports unencrypted, but only if both the client and server ask for it. If either one asks for encryption, then the connection is encrypted, even if there's no authentication (i.e. certificate). With no certificate, it's still possible to pull an active(MitM) attack, which is much harder to pull off at a large scale without anyone noticing (i.e. you can just collect all data you see).

Comment Re:Technically (Score 4, Interesting) 335

But there is definitely an allure to private schools, where the vast majority of the students are there to learn, most of the parents care enough to spend inordinate amounts of money on education, and the entire system is geared towards keeping your business and keeping those Ivy League acceptance rates up instead of ass-covering.

Having been to a private school, I can tell you that most of the focus is not education, but on looking good to the parents. I don't think teachers are any better (though probably not worse), and the main reason students are better come down to pre-selection (entrance exam, no poor children). The only fundamental plus is that they're allowed to expel troublemakers.

Comment Leave it alone (Score 4, Insightful) 218

The thing that bothers me most with Google (not just Gmail, Android too) is the constant change in interface. I use the average app about 2-3 times between UI redesigns. I don't care how great the new UI is if it takes me more time to learn it than the time it's going to save until the next redesign. How about you make your new designs 3x better and update 1/3 as often? Seems like it would help the vast majority here.

Comment Re:Bullshit (Score 1) 360

rho, g, h - the density of the fluid, gravity and the depth of the fluid.... not atmospheric pressure

Indeed, the difference in pressure is independent of atmospheric pressure. The only problem is that at the base of the column, the hydrostatic pressure equals the atmospheric pressure. Oh and you're not allowed to have a negative pressure!

Comment Re:Bullshit (Score 1) 360

and where do you think the hydrostatic pressure is from? You seem to be saying that I could build a siphon that starts at the top of a building, bring the pipe all the way up to the edge of space, then back down to the bottom of the building and the siphon would work fine? In any column of liquid of height h, with density rho, the change in hydrostatic pressure between the top and bottom of the column is going to be equal to rho*g*h (g=9.8 m/s^2). This is why for water, if you start with 1 atm and go up 10 m, you have zero hydrostatic pressure left. Beyond that you'll get a bit of surface tension, and then if you keep going up, your column will split unless you have some other force.

Comment Re:Bullshit (Score 1) 360

At 9 m high, the column of water can't break because that would create a vacuum and the atmospheric pressure of ~100 kPa is enough to push a column of water up to 10 high. OTOH, at 11 m, you'd end up with vacuum and two columns. It's the same reason you can't drink water from an 11m high straw, even if you have really powerful lungs. In any siphon, you need gravity to get the liquid to move, and you need some other force to keep the columns of liquid from separating around the highest point. That force can be atmospheric pressure, or it can be attraction between the molecules themselves (aka surface tension). At one point, any of these will break, or are you saying you can build a siphon that goes 100 km high?

Slashdot Top Deals

He has not acquired a fortune; the fortune has acquired him. -- Bion

Working...