Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!


Forgot your password?
Slashdot Deals: Deal of the Day - Pay What You Want for the Learn to Code Bundle, includes AngularJS, Python, HTML5, Ruby, and more. ×

Comment Re:Not a vulnerability in Java Commons Library (Score 1) 115

In an object oriented language an object is a combination of data and behavior (methods). If you want to transfer data across the wire with an object oriented system the natural place to put that data is into an object. Not trusting object serialization originates from a lack of knowledge on what is happening and you should educate yourself. Everything you want to know about serialization is here: https://docs.oracle.com/javase...

What you are doing by designing your own data formats is adding inherent whitelisting. Your reader/parser probably does a "new" on a specific set of classes. That prevents the type of vulnerability (arbitrary class loading) being discussed in the article but also requires you to reinvent the wheel for every data format.

You could have been using http://docs.oracle.com/javase/... to serialize data since that would give you an easy way to inspect the data type before recreating. You can even setup inspection/whitelisting with traditional object serialization if you wanted to: http://www.ibm.com/developerwo... .

Nowadays JSON is a pretty universal data format for wire transfers. You can deserialize JSON to trusted data-centric classes like Map, List, String, Integer, etc. That would give you universal encoding/decoding without arbitrary class loading. Unless you are required by a 2nd party to use some proprietary wire format there is no reason to roll-your-own encoding/decoding.

Comment Re:Not a vulnerability in Java Commons Library (Score 1) 115

The type of class loading you are talking about would only happen when using object serialization with RMI and codebase setup to allow for dynamic class downloading. Object serialization only sends the data portion of an object. If you want to know more you can look at how the format works: http://docs.oracle.com/javase/...

Comment 2 cheap KVMs (Score 1) 128

All three of your computers have dual monitor output. You have 2 monitors.

Put a 3+ computer KVM on each monitor, connect each computer to both KVMs.

The only drawback is you would have to press buttons on KVMs to change you modes, you wouldn't be able to use the keyboard shortcuts keys that some KVMs support.

Comment Phone lines might be cat5e (Score 1) 279

All my phone lines are cat5e. You just need to find where your POTS is wired into your internal lines and put in a switch and rewire the cables/jacks you want as ethernet instead of phone. If you don't have cat5e or better you either need to wire your house depending on the level of difficulty or just use 802.11ac.

Comment Re:Don't Worry, We Spent All the Energy Already (Score 1) 339

For my house:
The phones/tablets that the kids use take less power than the 2011 laptops.
The lcd tvs take less power than the projection tvs.
The coax line amp takes less power than the cable dvr that is gone in favor of OTA.
My Netgear R6300 uses a max of 38W vs the old WRT54g at 8W max, so that is the only less efficient device.

The secret of success is sincerity. Once you can fake that, you've got it made. -- Jean Giraudoux