Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror

Comment Re:Wait, you have to TYPE the password??? (Score 1) 309 309

Copy/paste cache scrapers exist, and are common for browsers with bugs. Training people not to copy/paste passwords is a good idea.

You're promoting perpetuating a long-standing, widespread and hugely-damaging user security error in order to avoid a relatively obscure problem which can actually be fixed through purely technical means. Not a win.

Comment Re:OpenID Connect scales at O(n^2) (Score 1) 309 309

What you describe as a problem is actually part of the solution. The problem with classic OpenID was that it was virtually impossible to get, say 1st Bank of MyButt, to use it, because absolutely anyone could be an identity provider. I personally agree with you that classic OpenID was better in that respect, but 1st Bank of MyButt doesn't. They're hemming and hawing about letting Google manage their user's identities, but they will at least consider it.

Comment Re:Wait, you have to TYPE the password??? (Score 1) 309 309

You're actually very wrong. Long complicated passwords are horrifically impossible to remember causing people to write them down or store them in managers with simpler passwords to open the manager.

Putting them in password managers is the right thing to do.

Length is all that matters for passwords. You're better off with "thatswhatshesaid" (26 ^ 16) than "B4c0nL0v3r!" (72 ^ 11). You're 162 times better off, in fact.

26 ^ 16 = 43,608,742,899,428,874,059,776 72 ^ 11 = 269,561,249,468,963,094,528

https://xkcd.com/936/

You're wrong. Hilariously so.

The entropy of "thatswhatshesaid" is far lower than 43,608,742,899,428,874,059,776. Randall Munroe calculated correctly in the XKCD comic, of course. He didn't assume that each letter was random, he assumed he was choosing four words at random from a dictionary of a specific size (about 2048 entries == ~11 bits of entropy per word). Your password is clearly not a selection of randomly-chosen words, and even if it were, it would likely have been from a much smaller dictionary.

This highlights the danger of asking users to pick passwords... even those who think they know what they're doing are likely to screw it up. Munroe's advice in 936 was good... but I think it has mislead more people than it has enlightened.

No, it's much better to use a password manager and let a computer pick large random passwords for you.

Comment Re:Drones (Score 1) 237 237

It's also a matter of fiscal costs. Just imagine the hell we could create if our congress critters could wage war without accumulating the huge debts like we have for our current middle eastern escapades.

Lowering all of the perceived costs for using violence to get our way is obviously going to make it a more appealing tool.

Comment Re:Not downsizing nuclear (Score 1) 460 460

"It would not ... as most CO2 is produced by cars, house heating and industry."
Since renewables only generate electricity we can ignore all none electrical sources as far as nuclear and renewables. Unless you want to count the tiny number of passive solar heating installations.
If you look at this graphic http://energytransition.de/fil...
You will see that France gets around 10% from hydro. You will also see that France still gets some power from coal which is baseload power is is ideal to replace with nuclear. The natural gas is probably split between base load and peaking load. Replacing the base load with nuclear is again a simple matter the peaking is a more difficult issue which is why I suggested that France should convert their hydro from a base load to a peaking source aka as pumped storage. The power stored would come from a combination of both renewables and nuclear.
As to your comment about where the majority of CO2 comes from do you have any sources?
My research shows that home heating in france is more often than not electrical heating. https://www.justlanded.com/eng...

Do you have any real data or just insults?

Comment Re:Wait, you have to TYPE the password??? (Score 3, Interesting) 309 309

If your password is "OPnuo(I&n hKUYNB68IOnih4wOIB*GBi234t73" as it should be,* then yes...

Parent was modded funny, but this is what your passwords should look like -- long and random, and typing them is a PITA. Any web site that disables pasting or prevents your browser or extensions from auto-filling passwords is broken. The sad thing is that most sites that do this (other than those that do it by accident because the devs are clueless) do it because they think they're increasing the security of their users' accounts. They're not.

Solutions like LastPass et al are the best, but honestly just using your browser's password database is better than reusing passwords everywhere. And Chrome and Firefox (at least, perhaps others) offer the option of keeping your passwords synced to all of the devices you use, optionally protected with a master password. Browsers need to offer password generation as well. I think some are working on it.

Of course, the real solution is to get rid of passwords. Web sites should switch to using OpenID authentication. Yes this means that most users will use their Facebook or Google logins, which means that, essentially, the site has outsourced its account security to those other entities. So what? If the developers of random web sites think they can do a better job of account security than Google or Facebook -- they're wrong . I work for Google and previously spent a decade as a security consultant in the financial industry and after seeing how they all work from the inside, I would feel much more secure about my bank account if I could use my Google account (with 2FA, plus all of the analytics and monitoring Google does) to log into it rather than trusting the bank to do a decent job with password-based security. I haven't seen Facebook's infrastructure, but I know people who work there, and they're good. Far better than you'll find at a typical bank, much less J. Random Web Developer.

Comment Re:Wesnoth isn't a game. Not really. (Score 1) 56 56

And the community doesn't respond well to these or any other criticisms. They like the random element, they don't seem to give a crap about characterisation, world build, lore or story telling.

FWIW, I'm not a member of the community. I play Wesnoth off and on for a few weeks every couple of years. I also like the random element and don't much care about characterization, world-building, lore or storytelling. Not that I don't like those things, just that Wesnoth is more of an occasional light diversion for me, so those things don't mean much.

Comment Re:Summary is wrong, management didn't "freak" (Score 1) 428 428

And why shouldn't they allow peer bombs? If the work was so great, then it more than justifies the $625 (5 people).

Sure, it does, which is why managers convert such things into spot bonuses -- which are generally several thousand dollars.

The downside of rewarding primarily with peer bonuses is that it might create a culture of doing good stuff for peers in order to collect peer bonuses rather than doing good stuff for peers because it's abstractly good to do good stuff for peers. I don't know how real it was or was not, but I have heard that some obnoxious Googlers with special skills or access or knowledge made a habit of demanding multiple peer bonuses before being willing to do some task for some other team that needed it. The "one bonus per" rule pretty much eliminates that because -- to people as well-compensated as Googlers -- a single $125 bonus isn't worth the overhead of negotiating; it's much more effective to just be "nice" and do stuff for people who need it, gathering the occasional peer bonus and lots of kudos, as well as building the network of people who will offer support at promotion time and/or help you out when you need it.

The effect is the same: it incents employees with special skills or access or knowledge to help their peers, but makes it more of a "gift economy" where everyone tries to be helpful to others in expectation of eventual good karma coming back to them, rather than one of barter and bargaining in which people jealously protect their advantages.

Comment Re:Summary is wrong, management didn't "freak" (Score 1) 428 428

Management didn't "freak". [...] Erica Baker's manager wasn't happy about it

For a Googler, your ability to reason logically, be critical and optimistic at the same time, and tersely state balanced, affect-free facts based on data, is weak.

"One front-line manager" != "management". The latter implies higher levels of company leadership.

Comment Re:ceph (Score 2) 214 214

we use Ceph, its fast, redundant, and crazy scalable, oh did i mention free (paid support)? ceph.com

Personally I've been using Ceph for the last few years myself. It has to be one of the best DFS's I've ever used. It includes security, speed, easy to expand by adding additional nodes. The free part was great. I found it looking through the repos one day. You can even tie it into other projects such as Hadoop (at least I recall reading it had a plug in a couple years ago).

Great product!

Comment Re:Meta data? (Score 2) 280 280

Well if things said about the law are used by lawmakers and judges to interpret the laws then yes, they should not be copyrightable. If a Harvard law textbook was being used by lawyers and judges to prosecute the law, then that textbook's copyright should be null and void also. Otherwise the law cannot apply equally to all.

We are drowning in information but starved for knowledge. -- John Naisbitt, Megatrends

Working...