Forgot your password?
typodupeerror

Comment: Re: Wireless security (Score 1) 82

by David Jao (#47798233) Attached to: Wi-Fi Router Attack Only Requires a Single PIN Guess
If you're using client certificates for authentication, and an attacker obtains the server cert, then the attacker can successfully fool you into thinking that you have connected to the real server, but the attacker cannot successfully fool the real server into thinking that you have connected to it. This kind of "half-MITM" attack is not usually thought of as a full MITM. The authentication protocol uses a challenge/response protocol which incorporates ephemeral keys and hence is not portable even between two entities both holding the same server cert. That is, if A and B both have the server cert, and A challenges C, and B obtains C's response to A's challenge, B cannot then impersonate C to A, since B does not know either C or A's ephemeral DH keys. Even if the attacker just blindly proxies between the real server and the real client, it won't work; in this case the communication would just be a real connection that the attacker can't decrypt or alter in any way thanks to forward secrecy.

Comment: Re: Wireless security (Score 1) 82

by David Jao (#47794097) Attached to: Wi-Fi Router Attack Only Requires a Single PIN Guess
Having all their traffic to and from one server is not as devastating an attack as having their password. For one thing, users tend to re-use passwords across multiple sites. I'm sure you can think of plenty of other reasons why client certs are at least *slightly* safer than username/passwords.

Comment: Re:The problem of Microsoft (Score 1) 337

by David Jao (#47663849) Attached to: Microsoft Surface Drowning?
You often can't customize your own install without breaking the law. The GP post specifically mentioned OEM Windows licenses as a way of getting cheap Windows licenses. This is no accident: OEM licenses are the only way to get cheap Windows licenses. Any sort of enterprise license will be far more expensive. But an OEM license is the least customizable of all the options. You can't even legally install an OEM licensed copy on any other machine other than the individual machine that the software came with, since an OEM license is tied to an individual machine. To get a custom install starting from an OEM copy, you can't just make one custom version and install it on all your machines; that kind of activity is specifically forbidden by the terms of the OEM license. You'd have to spend 30 minutes individually on each and every machine in your organization if you go the OEM license route and you don't want to break the law. Those 30 minutes of staff time are way more expensive than the bare-bones OEM license cost. Alternatively, you could purchase an enterprise license, but now we're no longer talking about cheap Windows licenses, we're talking about very expensive Windows licenses.

So, yes, you can customize Windows installs, but it's much more expensive to do so in any legal way, since you need an enterprise license, which really does cost ridiculous amounts of money. There is no cheap way to get customizable Windows. Even then, it's a bit of a hassle compared to Linux.

Comment: Re: The problem of Microsoft (Score 1) 337

by David Jao (#47647745) Attached to: Microsoft Surface Drowning?
It's not the price (free or pay). It's what you can do with the software. Apple software is still subject to BSA audits. You can't distribute customized versions. Things are slightly better in that hardware support is uniform and there are no client access licenses, but you also encounter new problems like Apple dropping software support for your hardware. Free software is just better. The cost of purchasing the software is insignificant. The time and hassle saved by free software is the real jewel.

Microsoft and Apple are poor choices unless your (sysadmin, IT, and staff) time isn't worth anything.

Comment: Re:The problem of Microsoft (Score 5, Insightful) 337

by David Jao (#47646661) Attached to: Microsoft Surface Drowning?
The Microsoft tax is not just about the monetary price of Windows. That's actually the least burdensome part of the tax. The real problem is the cost of license compliance. Most obvious are the direct costs: license management, purchase records, and receipt tracking. How much staff time are you going to spend on keeping track of Client Access Licenses? Is this expense worth it, when there are free platforms with no CAL requirements? I bet you didn't know the MS EULA gives the BSA the right to audit your premises at will. That's another huge overhead which simply does not exist with free software: A single small screw-up (almost inevitable, given the minuteness with which the audit is conducted) results in heavy fines plus having to pay the considerable costs of the audit. Compared to this insanity, anyone using exclusively free software can simply slam the door on the BSA and tell them never to come back unless they have a warrant.

Those are just the direct costs of compliance. The indirect costs of Microsoft's licensing model are something that even fewer users realize. You can't customize a distro and legally release the result to anyone outside of the organizational unit holding the license. You can't slipstream updates and legally distribute to outside parties. You can't create USB bootable media and legally release it to anyone else. Rescue discs and installation discs customized for particular hardware are left to the mercy of your OEM. All of these restrictions cause considerable friction which slows down the agility of your business. If nothing else, it makes it very hard to outsource IT functions; at most, you can hire contractors who have to keep your OS software bits separate from everyone else's OS software bits. How can this situation possibly compare favorably to free software where anyone can create and share anything? It really can't.

Comment: Re:Hash Collision (Score 1) 790

Finding an incidental collision in SHA512 is newsworthy. SHA512 is an iterated hash function (more specifically, a Merkle-Damgard construction). Any iterated hash function has the property that a single collision can be leveraged to produce arbitrarily many collisions. A single collision would destroy the entire utility of the hash function for almost any application that depends on collision resistance.

Comment: Re:Should the United States accept more foreigners (Score 1) 377

by David Jao (#47530167) Attached to: Western US States Using Up Ground Water At an Alarming Rate
First of all, the number claimed in your link is 95%, not 97%. Second of all, try making even basic efforts at fact checking. For example, your article claims 99.7% of poor families have refrigerators. This is plainly untrue -- homeless people don't have refrigerators, and they make up 10% of poor people. The numbers in the article are clearly unreliable and agenda-driven, which is not surprising, considering the source.

Comment: Re:Should the United States accept more foreigners (Score 2) 377

by David Jao (#47528909) Attached to: Western US States Using Up Ground Water At an Alarming Rate

For those with access to a supermarket, a combination of lack of time, lack of education, and lack of ability to delay gratification that causes people to eat junk food. Not money.

None of the above. For most poor and even lower-middle class families, the limiting factor is lack of access to food preparation equipment and facilities. Low-income housing often lacks a kitchen. Even if you have a kitchen, one often lacks appliances; trying to subsist on unprocessed food without a refrigerator or a stove is difficult to put it mildly. Families near the poverty line move from place to place a lot, often on short notice in response to evictions. There's no way they could maintain possession of bulky appliances under such circumstances, not to mention an adequate inventory of cookware.

Poor families are really living on the edge, much more than you realize. Once you get to the point where you can't afford a security deposit for an apartment, a lot of options close off. Food preparation is one of them.

Comment: Re:Should the United States accept more foreigners (Score 1) 377

by David Jao (#47528883) Attached to: Western US States Using Up Ground Water At an Alarming Rate

Food prices are high, but all of my meals (which are nutritious) cost $1-$2 max, usually closer to $1. You just have to know how and where to shop. Of course, this is the US, which is a first world country...

It is not enough to know how and where to shop. You also, generally, need a kitchen and appliances (stove, refrigerator, etc.) in order to produce nutritions $1 meals. Many poor and even lower-middle class families simply don't have these things. The kind of housing that you can get for cheap is going to be one-room boarding houses with limited access to food preparation facilities. You're lucky to have even a shared kitchen. As for appliances, they're not actually very expensive -- an iPhone costs more -- but poor families generally move far too often (usually involuntarily) to maintain possession of bulky items.

The other line moves faster.

Working...