Forgot your password?

typodupeerror

+ - Microsoft reads your Skype chat messages-> 1

Submitted by Anonymous Coward
An anonymous reader writes "A Microsoft server accesses URLs sent in Skype chat messages, even if they are HTTPS URLs and contain account information. A reader of Heise publications notified Heise Security (link to German website, Google translation). They replicated the observation by sending links via Skype, including one to a private file storage account, and found that these URLs are shortly after accessed from a Microsoft IP address. When confronted, Microsoft claimed that this is part of an effort to detect and filter spam and fishing URLs."
Link to Original Source

Comment: Re:Only 20? (Score 1) 300

by Khopesh (#43713499) Attached to: Browser tabs I have open right now ...

Yeah...if they had had categories for 20-50, 50-100, 100-200, 200+ we might get some actual results.

I was frankly quite surprised that the 20+ category wasn't orders of magnitude more popular. As of this writing, the tally is 8818 vots for 1-5 tabs versus 8304 (3256+1476+768+2804) for 6+. That really does not sound realistic.

I have 154 tabs open right now, and even then only because I've recently purged a bunch. However, only 38 of them are actually loaded at the moment (huzzah for session management/crash recovery!).

Using an add-on like Tab Mix Plus can help (or empower, which may be a mixed blessing); I've configured it to show me three rows of tabs at a time, and I can scroll them vertically with the mouse wheel, much like a filing cabinet. Really, it's just super-intensive AJAXy apps like Facebook that hog memory and resources. Those need to be kept to a minimum while others are fine.

And I would have actually had to ~count my tabs.

Assuming Firefox, hit CTRL+SHIFT+E (I'm not sure of the Mac equivilent) to go to the Group Your Tabs view. Not it's just a matter of counting rows and columns and then multiplying.

Comment: Re: GUIs: GIMP vs Photoshop (Score 1) 658

by Khopesh (#43678221) Attached to: Adobe Creative Suite Going Subscription-Only

Single-window mode has absolutely nothing at all to do with why the GIMP GUI sucks. Switching to single-window mode is actually worse, not better.

It seems like 80-90% of the complaints regarding GIMP's UI are from people who won't be satisfied with anything but a full Photoshop GUI rip-off (e.g. the way LibreOffice mimics MS Office; Gimphoto and the defunct GIMPshop get close on this front). Their top issue is (well, was) the lack of a single-window mode. To shut them up, given how trivial it was to implement, it was added. I agree with you on the fact that the mode doesn't improve the UX, but it does shut down the #1 complaint, which is something.

What else is (independently) bad about the UI? I started my graphics career on Paint Shop Pro (a plugin-compatible Photoshop knock-off that I actually preferred due to better use of the right mouse button) and was able to seamlessly upgrade to Photoshop given the similar UI. GIMP therefore had a steep learning curve for me, but I have grown to prefer it over time (though I still have to hold back from certain ~hard-wired PSP keyboard shortcuts).

I think the real issue here is merely that GIMP is not a Photoshop clone and image professionals aren't as proficient with computers as professionals of other industries that spend similar amounts of time on computers. They took a very long time (running through tutorials and perhaps paid classes) to learn Photoshop, and there are no equivalents for GIMP (at least, not with the same polish, which these users need), not to mention the fact that it's a serious time (and often monetary) commitment. The only solutions for these uesrs are to make GIMP bi-modal (GIMPshop mode) or to both improve overall computer proficiency (which is happening over time anyway) and create highly polished tutorials and professional courses on GIMP.

Even then, GIMP would still need to absorb (or better partner with) the features currently relegated to the Separate+ and PSPI plugins.

As I've said elsewhere in this article's comments, GIMP is not really professional-grade, it's just close enough for people to make the comparison. LibreOffice has commercial backing, as does the Linux kernel, as does WINE. Perhaps what GIMP "needs" is a commercial backer, that implements new features within a non-free plugin suite (and/or a fork that somehow gets around the GPL) and expands GIMP's base to maintain compatibility, even slowly trickling their commercial features into GIMP over time so as to merely represent what the Free Software version will get in a release or two.

Comment: Re:I tried this... (Score 4, Informative) 658

by Khopesh (#43648575) Attached to: Adobe Creative Suite Going Subscription-Only
For that list, you've only got a year or two left to wait:

1. 16bpc (and 32bpc) (native, pending for GIMP 2.9+)
2. CMYK (Plugin, supporting GIMP 2.4+)
3. Single-window mode for GUI (native, GIMP 2.7.3+)

You only used one out of three, you guys are putting less effort into this as the years go by. Guess Gimp has been winning for a while now :)

Now who's not putting in enough effort? ;-)

Comment: GIMP 2.10 to support 32bits per color channel (Score 3, Informative) 658

by Khopesh (#43648387) Attached to: Adobe Creative Suite Going Subscription-Only

Still no support for 16-bit per channel after all these years.

Isn't that implemented by the Generic Graphics Library (GEGL), partially implemented in GIMP 2.6 with a migration path that should end with GIMP 2.10 (the next version) fully utilizing it? 2.10 has been specifically noted as supporting 16 (and 32!) bits per color channel. That link, from a year ago, even has a screen shot. Still, 2.10 doesn't have a release schedule, and despite that the developers are committed to "shorter development cycles," it looks more like it's still a ways out (2.9, the dev pre-release, is still several months out at the earliest). Still, it's heartening to know they're on the right path (and that they've gotten around the design flaws that preiviously made this kind of feature impossible to implement).

The worst thing about GIMP is that its existence leads the FOSS community into complacency. People need to realize that there really is no good open-source competitor to Photoshop and start working on one, rather than pretending that GIMP fits the bill and then arguing with creative professionals who repeatedly point out why it doesn't.

Again, GEGL comes to the rescue. The whole point of it is to make it a library so it can be used from GIMP or any other utility. It represents that ground-up rewrite you so desperately plea for.

Regarding a professional-grade tool ... Free Software never really offers that. You can get close, and sometimes you get lucky, but for the most part, there is no free ride. Generally, the best you can hope for is a commercial closed-source application that works well in an otherwise Free Software environment. It's icing on the cake when the vendor of such software offers a Free version of it (e.g. Codeweavers and Crossover vs WINE).

There's always "more" work needed, and for high-end items like the Photoshop features missing from GIMP, there's rarely enough community-driven (read: volunteer) time and energy to make it happen. It's worth noting when a major feature is missing, as car mechanics tend not to be racecar drivers (as mentioned elsewhere in the comments), but it's not worth complaining unless you're rolling up your sleeves and/or putting up a bounty to make developers' time easier to allocate.

Government

Eric Schmidt: Regulate Civilian Drones Now 420

Posted by Soulskill
from the ban-telescopes-and-corrective-lenses-as-well dept.
An anonymous reader writes "Google Chairman Eric Schmidt is urging lawmakers to regulate the use of unmanned aircraft by civilians — and quickly. He posed this hypothetical situation to The Guardian: 'You're having a dispute with your neighbor. How would you feel if your neighbor went over and bought a commercial observation drone that they can launch from their backyard. It just flies over your house all day. How would you feel about it?' Schmidt went on to bring up military and terrorist concerns. 'I'm not going to pass judgment on whether armies should exist, but I would prefer to not spread and democratize the ability to fight war to every single human being. It's got to be regulated... It's one thing for governments, who have some legitimacy in what they're doing, but have other people doing it... it's not going to happen.'"
Security

+ - Africa's Coming Cyber-Crime Epidemic->

Submitted by
jfruh
jfruh writes "Those Nigerian spam scams of the last decade may have just been the first step in a looming African cyber-crime wave. Africa has the world's fastest-growing middle class, whose members are increasingly tech-savvy and Internet connected — and the combination of ambitious, educated people, a ceiling on advancement due to corruption and lack of infrastructure, and lax law enforcement is a perfect petri dish for increased cybercrime."
Link to Original Source

Comment: That's HALF of NASA's budget (Score 5, Informative) 64

by Khopesh (#42446299) Attached to: Russian Space Industry To Receive $69 Billion Through 2020

That's a lot of money for space research. . Do they know something we don't?

What are you talking about? No it is not!

They use some of that money for manned space missions rather than for research. Still, their previous $3 billion annual budget could afford to send men to space while NASA's $18 billion annual budget apparently cannot. Now Russia announces a spending increase up to USD$68.71 billion over eight years (USD$8.59b a year), roughly half of what NASA's sliced up budget is currently.

Neil deGrasse Tyson's video pleas We Stopped Dreaming and its follow-up A New Perspective proposed we increase NASA spending to 1% of the US Federal Budget (current spending: 0.49%) suggests we could go to Mars and innovate the way we did in the 70s. That's significantly more than Russia's new investment and would help us keep our lead. Otherwise, we're losing both innovation and innovators.

I'd like NASA to be funded by the largest of:
* 1% of the US Federal Budget ($3.8t -> $38b in 2011)
* Half of the US DOD's Research, Development, Testing & Evaluation budget ($79b -> $39b in 2010)
* 5% of the whole US Military budget ($550b -> $27b in 2011, $708b -> $35b in 2012)

This extra funding would come from otherwise allotted military spending (so an increase to the military budget would typically increase NASA's budget as well). As I noted a few paragraphs earlier, this would roughly double the current $18b budget and would bring us to Mars.

Comment: Re:who is doing this? (Score 1) 212

by Khopesh (#42405575) Attached to: Lax SSH Key Management A "Big Problem"

For this reason, there are lots of security-conscious departments that ban SSH key access on any external-facing system.

So what your telling me is that they decided that a password that said user probably wrote on a sticky-note attached to their laptop or saved in a plaintext password is more secure than a ssh private key that MIGHT not be password protected?

If a user isn't going to properly secure an ssh private key, there is no way in hell they are going to properly protect a password!

I've been in IT. I've seen it first hand. These people do understand and have decently secured systems, but trade off security for convenience rather than learning ssh-agent, missing the point that their perceived "minor" security issue isn't as personal as they think and risks exposing things like code trees and proxies to would-be attackers.

My "solution" was to serve on an alternate SSH port, since they also didn't use ~/.ssh/config, so anybody stealing their keys would also have to troll their ~/.bash_history to figure out what the keys opened. I also walked around the office and emailed people with walkthrough instructions for using ~/.ssh/config and ssh-agent/Pageant (PuTTY's agent) on Linux, OS X, and Windows.

Comment: Re:Inability of server to enforce policy (Score 1) 212

by Khopesh (#42398307) Attached to: Lax SSH Key Management A "Big Problem"

There are two (very ugly) "secure" solutions to this.

1. Draconian: The IT department requests the private key, tries to brute force access, then deletes it after a certain degree of failure. IIRC, pubkeys can be generated from private keys without passwords, so it's verifiable. Big snag: the user could remove the password later. As long as the private key is safely and securely submitted (say via an SSL form) and safely/securely stored during the brute forcing, this is as secure as your trust in the sysadmins (and/or your password strength).

2. Policy: enforce via required educational video or similar nonsense plus a legal contract. Best done in physical form since nobody actually pays attention to EULAs and whatnot. Can be combined with Draconian #1 above.

Comment: AuthorizedKeysCommand can police this easily (Score 1) 212

by Khopesh (#42397539) Attached to: Lax SSH Key Management A "Big Problem"

In my opinion, this is the interest of the new authorizedkeyscommand. A sample usage is available at http://www.sysadmin.org.au/index.php/2012/12/authorizedkeyscommand/

Nice! AuthorizedKeysCommand (introduced 2012/10/31) can do exactly what we need: Set up a script that (securely) logs key usage and e.g. deny any key that is older than 366 days (by first use or else filesystem timestamp) and hasn't been used in 90 days or for any user whose last login (regardless of which key) was over 60 days ago, with a list of exceptions (by key, not user).

That's still messier than something that can go right into the authorized_keys file as a parameter, but it would do the trick handily.

Comment: Re:who is doing this? (Score 1) 212

by Khopesh (#42397123) Attached to: Lax SSH Key Management A "Big Problem"

Who exactly is it that isn't password protecting their ssh keys? I mean if you choose to press enter shame on you.

From the IT policy standpoint, there's no way of requiring that a key has a password. There are lots of people who don't understand (or otherwise care to use) ssh-agent and similar mechanisms, and there are lots of people who assUme that their own systems' security is sufficient and don't realize that it jeopardizes the security of the IT department's systems.

For this reason, there are lots of security-conscious departments that ban SSH key access on any external-facing system.

Security

How Do YOU Establish a Secure Computing Environment? 314

Posted by Unknown Lamer
from the can't-root-this dept.
sneakyimp writes "We've seen increasingly creative ways for bad guys to compromise your system like infected pen drives, computers preloaded with malware, mobile phone apps with malware, and a $300 app that can sniff out your encryption keys. On top of these obvious risks, there are lingering questions about the integrity of common operating systems and cloud computing services. Do Windows, OSX, and Linux have security holes? Does Windows supply a backdoor for the U.S. or other governments? Should you really trust your Linux multiverse repository? Do Google and Apple data mine your private mobile phone data for private information? Does Ubuntu's sharing of my data with Amazon compromise my privacy? Can the U.S. Government seize your cloud data without a warrant? Can McAfee or Kaspersky really be trusted? Naturally, the question arises of how to establish and maintain an ironclad workstation or laptop for the purpose of handling sensitive information or doing security research. DARPA has approached the problem by awarding a $21.4M contract to Invincea to create a secure version of Android. What should we do if we don't have $21.4M USD? Is it safe to buy a PC from any manufacturer? Is it even safe to buy individual computer components and assemble one's own machine? Or might the motherboard firmware be compromised? What steps can one take to ensure a truly secure computing environment? Is this even possible? Can anyone recommend a through checklist or suggest best practices?"
Privacy

Lax SSH Key Management A "Big Problem" 212

Posted by Unknown Lamer
from the we're-all-doomed dept.
cstacy writes "Tatu Yionen, inventor of SSH, says he feels 'a moral responsibility' to come out of retirement and warn that a 'little-noticed problem' could jeopardize the security of much of the world's confidential data. He is referring to the management (or lack thereof) of SSH keys (i.e. 'authorized_keys') files. He suggests that most organizations simply allow the SSH key files to be created, copied, accumulated, and abandoned, all over their network, making easy pickings for intruders to gain access. Do you think this is a widespread problem? How does your company manage SSH keys?" cstacy's summary here is accurate, but as charlesTheLurker notes, the article is a bit over the top: "The Washington Times claims that there's a huge vulnerability in ssh. It turns out that some reporter there has discovered that you can do passwordless login with the software, and has spun this into a story of a dangerous vulnerability. Sigh."

Blessed is he who expects nothing, for he shall never be disappointed. -- Alexander Pope

Working...