Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
×

Comment Re:What a shame (Score 1) 171

Just like a malicious client can suck data out of a vulnerable server, the same can work in reverse, though clients tend not to keep an SSL connection open any longer than they need to (unless, it's IMAPS or FTPS or chat or some other application with persistent connections).

If you suck the private key out of a bank webserver's RAM, then perform a MITM attack on the bank users using the bank's own certificate, not only can you get their bank credentials (by them filling in the form and sending it to you), depending on the browser you may or may not be able to suck up other accounts from them (eg user logs into a credit card company site to see their bill, then logs into your fake bank to see if they can pay it).

Comment Re:Subtle attack against C/C++ (Score 1) 189

std::containers don't need to store their size as a separate variable

C strings don't either. It's the protocol that said "hey, rather than null terminating strings, let's put a length byte like Turbo Pascal never went out of style!"

The fun thing is that that design decision has lead to an entire CLASS of SSL bugs (in all stacks, not just openSSL) eg invalid certs validating because of a null byte in the Common Name. And heartbleed was just one more in that heap.

Comment Re:No shit, Sherlock (Score 1) 135

As Ike mentioned in his speech widely remembered for the line 'military-industrial complex':

This conjunction of an immense military establishment and a large arms industry is new in the American experience. The total influence -- economic, political, even spiritual -- is felt in every city, every State house, every office of the Federal government. We recognize the imperative need for this development. Yet we must not fail to comprehend its grave implications. Our toil, resources and livelihood are all involved; so is the very structure of our society.

In the councils of government, we must guard against the acquisition of unwarranted influence, whether sought or unsought, by the militaryindustrial complex. The potential for the disastrous rise of misplaced power exists and will persist.

We must never let the weight of this combination endanger our liberties or democratic processes. We should take nothing for granted. Only an alert and knowledgeable citizenry can compel the proper meshing of the huge industrial and military machinery of defense with our peaceful methods and goals, so that security and liberty may prosper together.

....and the bit people don't seem to remember, nor take as seriously:

Akin to, and largely responsible for the sweeping changes in our industrial-military posture, has been the technological revolution during recent decades.

In this revolution, research has become central; it also becomes more formalized, complex, and costly. A steadily increasing share is conducted for, by, or at the direction of, the Federal government.

Today, the solitary inventor, tinkering in his shop, has been overshadowed by task forces of scientists in laboratories and testing fields. In the same fashion, the free university, historically the fountainhead of free ideas and scientific discovery, has experienced a revolution in the conduct of research. Partly because of the huge costs involved, a government contract becomes virtually a substitute for intellectual curiosity. For every old blackboard there are now hundreds of new electronic computers.

The prospect of domination of the nation's scholars by Federal employment, project allocations, and the power of money is ever present and is gravely to be regarded.

Yet, in holding scientific research and discovery in respect, as we should, we must also be alert to the equal and opposite danger that public policy could itself become the captive of a scientifictechnological elite.

The pernicious influence of this 'Federal technical complex' has led to an entire generation of scientists who believe that the only credible source of funding must be the federal government.
It is absolutely certain that there are some HUGE projects that need the resources of government, no doubt. But you know what? Not every bloody thing *needs to be researched*, nor does that research need taxpayer dollars.

I know, the idea that research needs to demonstrably benefit the taxpayer to be federally funded sounds like an idea that would come from (shudder) Republicans, but when we're overspending our budget by 30%+ every year to the tune of nearly $1 trillion, we can't afford everything we want, only what we clearly need.

Comment Slashdot settings help please (Score 4, Interesting) 163

Let's say hypothetically a slashditor (let's call him "Supnezmas"), when not posting duplicate articles from 2 days before, has a major erection for some web commenter (let's call him "Notlesah, Ttenneb").

How could I edit my settings so that worthless shit articles from "Supnezmas" referencing this "Notlesah, Ttenneb" were somehow downrated to oblivion so I don't see them anymore, ever? Is there a filter I can apply?

Can I "foe" an editor based on context?

Comment Re:What is going on?? (Score -1, Troll) 163

I'd like to know who the flip is XanC, since you asked the SAME question I did, and I got -1,Troll while you got +5 Insightful?

http://slashdot.org/comments.p...

Note however that I *entirely* agree with you.
Is there a /. editor trying to build a buddy into a web celebrity?
FWIW, I *still* don't really get why Ze Frank is a weblebrity, either. How does one make a living doing that?

Comment Can they pay back the $$ they stole? (Score 1) 38

If not, throw them into a wood chipper.

Seriously, if the potential reward for crime is in the $million$, the odds of getting caught are probably low, and the punishment is a handful of years in prison - why would anyone NOT commit such a crime?

Most of the people I know work their lives as wage-slaves for 8+ hours a day, for decades, for a fraction of that (and what they get, a giant chunk goes to taxes).

Comment Re:MK Observer (Score 1) 236

It reads like it was spewed out by a markov chain generator trained on a tiny subset of language to make sure that its rambling stays on topic, but still makes no guarantees that it comes out in English.

Maybe that's what the MK means? I had a look at the other stories on the site:

The issue is these venues value their transactions off of the distributed costs on the exchanges – in addition, if those costs need uprightness, then “darkpool” evaluating will itself be twisted.

-- http://www.mkobserver.com/high...

Whatsoever it is, the tinkle about the blip demonstrates that individuals are looking at the rover photographs nearly. An imaging master at NASA’s laboratory imparts his hypothesis: An “cosmic beam hit” influenced Curiosity.

-- http://www.mkobserver.com/nasa...

Some of the less gibberish articles have writing/editing citations at the bottom, maybe they are generated by a computer then cleaned up afterwards? Others are quite clearly press releases.

Comment Drilling down deeper (Score 4, Interesting) 386

I would also point out that the "US" - commonly condemned in such statistics - is probably the least homogenous country in the world. As such, it's probably useful to look at the state by state rankings, both positively and negatively:
(ranked by deaths per 100k)
1. District of Columbia 30.8 http://www.city-data.com/forum...

Comment Re:for a library... (Score 1) 447

... so much of the internet depends on for security just one reviewer for a commit seems way way way too little, honestly checking anything into openssl (or gnutls) should be at least a 4-step approval process (submitter -> mantainer for that area -> overall library mantainer -> security officer), for any code that includes buffers/malloc especially if related to user supplied data the final security review should be a panel.

Plus three extra steps: compiles without warnings, passes Valgrind, and makes it through an intensive test suite.

Slashdot Top Deals

"Engineering without management is art." -- Jeff Johnson

Working...