Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×

Comment Re:As a max time limit before entering public doma (Score 2) 360

The original framers of the constitution recognized this at the founding of the republic.

"The Congress shall have Power To...promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries...."

Nobody objects to people having the protection of a limited copyright so that they can profit from their ideas. Everyone - including, I'd argue, most copyright holders but excepting apparently their very successful lobbyists and tame congresspeople - agrees that "copyright" != "rights to exclusivity in perpetuity so that person and their heirs never have to work again".

You do realize that SCOTUS has ruled that limited times is subject to the "I'll know it when I see it" rule of being out of bounds. They have yet to see a number that they've declared limited. Of course, it's all about perspective. In a geologic time scale, then 100 years is very "limited".

What I would like to see is a "short-circut" timer based on dates of publication. If a work is not published at all (made available to the public in some form), then it gets a shorter protection time. Once a work is published, the date it is no longer available (ie, the book goes out of print, the software is no longer sold), then another timer starts - you have X amount of time to re-publish it (say 10 years) or it passes into the public domain.

Comment Re:Ronald Regan revisited (Score 1) 179

As Regan looked at the world through the fog of dementia and dirty windows at the White House he couldn't distinguish between movie scripts and reality. (Remember the refit of the New Jersey?) It seems that Cameron has lost more than a few brain cells too.

This is what happens when the GCHQ uses the neuralizer too much.

Comment Re:Like my momma said ... read the fine print (Score 1) 390

Following the link referenced we get: "From the statistics below (collected from W3Schools' log-files over a period of ten years), you can read the long term trends of browser usage."

So this data set really shows only the behavior of access to the w3schools.com site. Don't make inferences across the general population.

I also note that they don't say WHAT drives that percentage? Is it based on IP addresses or raw page views? Could it be that Chrome users have to look up how to do basic web crap more often? Maybe IE dropped because those on Windows platforms are using Visual Stdio with its own built-in help. There is no way you can make any educated inferences from this data. This is another stunt to get Slashdot pageviews.

Comment Re:More reprsentative stats please (Score 1) 390

Yes, but remember "Developers, Developers, Developers!". If the developers start abandoning IE, then your platform will no longer have the best experience and further encouage users to move to others, like Firefox/Chrome.

This is simply saying that most developers use something besides IE for their day-to-day browsing activities (and/or help lookup). This does not say anything about the browser mix that they have to (a) design for, or (b) test with. This is like looking at the White House and saying that the Congress must not have any Republicans.

Comment Re:interesting idea (Score 1) 106

So you decrypt something and it *looks* like real data.

So it would have to be a function that produces 'good' results and 'bad results' but the bad results look like good ones.

Would have to be careful that the 'bad' results do not do things like open the lock though. For instant in the case of login list breaches.

If randomly generated "fake" data matches someone else's password (or whatever is being encrypted), that other person didn't use a strong enough password. This system is just acting like a hash function -- criminal tries password A and he decrypts the data to some string, then he tries password B and the data gets decrypted to another string. If those randomly generated strings happen to match someone elses password on the system, the criminal could have saved himself some time by generating the password guesses himself.

What's the goal here - to make the returned data "not my data", or "incorrect data"? There is a world of difference between these two. "Not my data" is a simple thing to generate, but could still be correct data. IE, if the data protected is a card number, and the generated number matches someone else's card, then do we care or not? The criminal doesn't care, as long as their goal is met (get a valid card - it doesn't have to be yours). If we're talking about "invalid" data, then we need some mechanism to validate the generated data before it's returned. While this wouldn't meet the criminal's goal, it could open a possible DDOS attack vector on the validation service (ie, a brute force becomes a magnified reflection attack).

They aren't going to store a big database of valid credit card numbers so they can return someone else's card number, they'll just generate a random number that looks like it could be a real credit card number and passes the checksum test.

Yes, a criminal could take the credit card numbers from each decryption attempt and test them, but if he's willing to test millions of card numbers to look for a valid one, he could just generate the card numbers directly and not attempt the decryption in the first place.

If we're simply returning a random string that "looks" valid, then this method of protection works. If we return a known invalid number, then we now have a test that the attacker can use to validate the password input. It does take one additional step (validate the result).

Comment Re:Security through obscurity (Score 1) 106

I guess it DOES have some benefit, huh?

People misunderstand what "security through obscurity" means. Most (all?) encryption relies on security through obscurity at some level.

Hiding your house key under a loose floorboard in your back deck is the kind of security through obscurity that can really work, assuming that there are no other clues that lead to the hiding place. However, hiding the prybar that you use to pry up the floorboard under the belief that hiding the method of access makes your key safer is not the kind of obscurity that works because if the attacker can find your hiding place, he can figure another way to get to the key.

Similarly, hiding or not writing down your password is security through obscurity that works. But trying to hide the implementation details of your cipher algorithm does not, because cryptoanalysis can break your encryption even without access to your encryption algorithm.

So, obscuring your real password among an endless number of fake passwords is the kind of obscurity that can work -- even if the attacker knows that your password is somewhere among the billions of fake ones, unless he has some clue to tell him what your real password looks like, just knowing that fakes are there doesn't help him.

Of course, they could use the prybar to simply break a window, or pry open the door, invalidating the purpose of the hiding place entirely. So hiding the prybar, while it doesn't directly affect the hiding space, helps increase overall security of the system.

Comment Re:interesting idea (Score 1) 106

So you decrypt something and it *looks* like real data.

So it would have to be a function that produces 'good' results and 'bad results' but the bad results look like good ones.

Would have to be careful that the 'bad' results do not do things like open the lock though. For instant in the case of login list breaches.

If randomly generated "fake" data matches someone else's password (or whatever is being encrypted), that other person didn't use a strong enough password. This system is just acting like a hash function -- criminal tries password A and he decrypts the data to some string, then he tries password B and the data gets decrypted to another string. If those randomly generated strings happen to match someone elses password on the system, the criminal could have saved himself some time by generating the password guesses himself.

What's the goal here - to make the returned data "not my data", or "incorrect data"? There is a world of difference between these two. "Not my data" is a simple thing to generate, but could still be correct data. IE, if the data protected is a card number, and the generated number matches someone else's card, then do we care or not? The criminal doesn't care, as long as their goal is met (get a valid card - it doesn't have to be yours). If we're talking about "invalid" data, then we need some mechanism to validate the generated data before it's returned. While this wouldn't meet the criminal's goal, it could open a possible DDOS attack vector on the validation service (ie, a brute force becomes a magnified reflection attack).

Comment Re:Dont do anyone any favors (Score 1) 644

I don't think you can blame the parents for "fucking over" the donor: it's the Kansas Department for Children and Families that has brought the case, and the recipients of the funds may not have a say in the matter.

And the Kansas Department for Children and Families is completely right about this: Two persons cannot make any contract or agreement that takes away the rights of a third person. It is the right of the child to get support from his biological parents. The mother cannot decide that the child should not exercise this right. Even as a legal guardian of the child she can only make decisions for the child that are in the interest of the child. But not getting support from the child's farther is in the interest of the mother but not in the interest of the child.

Then all adoptions are illegal and invalid. Your assumption is wrong.

Comment Re: Dont do anyone any favors (Score 2) 644

Virgin Mary story would have lost them benefits from the state. This is a story of the Govt controlling who can have kids and who can't and one could even argue it's discrimination by the govt, because by saying "all your signed legal donor contracts are worthless" the govt is essentially saying "sorry lesbians if you want children you better pay $20,000+ for artificial insemination from a doctor" and requiring same sex couples to pay $20,000 or their child isn't really theirs is a great way to prevent same sex couples from having children at all. With the court ruling the father is still legally the father in this case means any same sex couple who had a child without artifical insemination could face a custody battle someday.

To prevent kids from being on welfare, we should require that parents deposit $100,000 with DCF before they are allowed to have unprotected sex. If they can't afford that, they can't afford to pay for the kids, and should be forcibly sterilized so we don't have all these children in poverty. It's for the children! WHY DON'T YOU THINK OF THE CHILDREN!?

Comment Re:Dont do anyone any favors (Score 1) 644

The agency said it also received different versions of the donor contract from Marotta and Schreiner, suggesting that the document "may be invalid on its face."

Had the contracts matched and been witnessed by doctor or even a $15 public notary then the outcome may have been different.

This is the true issue in this case. There are multiple versions of the contract, and each party has a differing version. In these cases there are two tracks for the court to take - attempt to reconcile them, or throw the contract out. Sounds like the court took the easy way out and tossed the contract, which invalidates the parental rights transfer. I will note that adoption and donation contracts are the most legally scrutinized contracts due to the impact on many lives. If there's t's dotted and i's crossed it will probably be tossed. Writing your own contract for donation or adoption is a very bad idea - as these people are finding out.

Comment Re:Dont do anyone any favors (Score 1) 644

Since he has been found by the court to be financially responsible for the child, is he going to be given the normal tax breaks associated with dependents?

I don't think so. In cases I have seen, the father does not get to claim the child as a dependent even if he is supplying more than 50% of the cost of raising the child. Often, the father has to fight and sometimes loses, to be able to see the child he is paying for.

This is not entirely true (at least for federal tax purposes). It is true that only one parent can claim a child. If you are paying 50% or more, or the child lives with you more than 50% of the time you can claim the child. However, to guarantee that the child is not claimed twice, the person claiming the child must file an additional form for each child, that the other parent has to sign (see IRS Form 8332).

I know this, because I have to have this done every year. It's a pain, but if everyone can talk to each other, it's not too big a deal. Also, most divorce decrees have this listed as a condition in them as well.

Comment Re:Dont do anyone any favors (Score 5, Interesting) 644

You're correct, but isn't it sad?

If you really think it is so sad, why don't you call up the Kansas DCF, and volunteer to support the kid yourself? It may be sad that the responsibility is being forced on an unwilling dad, but it would be sadder if it was forced on unwilling taxpayers.

Because that's not allowed. Only parents can have any say in anything about a child. Except the police. And DCF. And the state legislature.

What's sad is that the state is using a technicality to override a valid contract, over the objections of all other parties. I wonder what impact this may have on parental rights contracts in adoptions? The issues are very similar - sign your parental rights over another party. So if an adoptive parent goes on welfare, can the welfare office retroactively cancel the adoption because it cost the state money?

Comment The bigger tragedy? (Score 1) 276

What's the bigger problem here - that people choose insecure passwords, or that the systems involved ALLOW them to choose known insecure passwords? Any password system these days should be able to disallow these common passwords out of the gate. If they can't be bothered to make sure their customer's password is difficult to crack, how can we believe that any other aspect of their security is up to par? I would note that most of the password leaks have come from folks that use insecure methods to hash or simply obscure their password storage, against all recommendations by the security industry.

Comment Re:completely agree (Score 1) 276

A site like Adobe, if I had to have an account there for some reason, would have no relationship to other accounts, would need no particular security because it would be unimportant, and even remembering a password would be too much bother.

Now Slashdot, my password for that is important, it's *************8**

Is that 12 or 13 stars before the 8? I keep trying to log in as Anonymous Coward with the password you provided and it's not working. Or does the 8 need to be capitalized?

Maybe we should use the old Trek phrase KAAAAAAAAHN and vary the number and capitalization of the A's. That should work.

Slashdot Top Deals

"God is a comedian playing to an audience too afraid to laugh." - Voltaire

Working...