Forgot your password?
typodupeerror
Firefox

How the Mozilla Sniffer Backdoor Was Discovered 201

Posted by CmdrTaco
from the hate-when-that-happens dept.
An anonymous reader writes "Mozilla pulled one of their Firefox add-ons earlier this week for containing a backdoor which stole passwords from its users. Netcraft has taken a closer look at how the rogue extension worked, and how it was discovered by chance rather than through any code review process. Mozilla are working on a new security model to stop this kind of backdoor happening again."

Comment: Re:Encryption isn't free (Score 1) 660

by acidblood (#30809354) Attached to: What's Holding Back Encryption?

Eh, go run an `openssl speed rsa' benchmark and see what kinds of results you get.

In my MacBook with a Core 2 Duo 2.4 GHz CPU, I get 30 RSA-2048 private-key operations per second, and 1042 public-key operations per second. One of these operations is used on every SSL handshake, not sure which of the two, so I can't really say whether performance is only `really bad' or `eye-poppingly awful'. Sure the performance drain would be a myth if we only used symmetric encryption, but key exchanges can only take place on an insecure channel if public-key encryption is used.

Performance on the client is irrelevant, it doesn't have to perform hundreds if not thousands of encryptions per second like the server does.

Comment: iPhone 3G/3GS GPS bug (Score 5, Interesting) 275

by acidblood (#30148314) Attached to: Bizarre Droid Auto-Focus Bug Revealed

Since we're talking about phone bugs, here's one I had to fight with for a while...

Lots of users are having problems with the GPS functionality on the iPhone 3G/3GS (see e.g. here). No apparent pattern there, but in Brazil, lots of users from one specific carrier were having GPS problems, and the beginning of these problems coincided with the start of Daylight Savings Time in Brazil. My iPhone, as well as my girlfriend's, are with this carrier and were experiencing the problem. Those with unlocked phones report trying other carriers' SIM cards and had GPS working again, but once you popped back the problematic carrier's SIM card, the GPS was dead again.

This nearly drove me nuts as I paid an obscene amount of money for the TomTom app and couldn't get it to work, so keeping up with the engineer spirit, I tried to debug the problem myself. I observed an interesting fact: there's a Clock app on the iPhone with a World Clock pane, and if I added a clock from any time zone, including my own, it was off by one hour. However the iPhone's main clock, shown on the top of the screen, was showing the right time. Eventually I discovered that if I restored my phone as a brand new phone (not restoring from backup) the GPS would work fine and world clocks would be fine... until you reboot the phone. After rebooting, the GPS is gone again and the world clock is off by one hour again.

Now you might ask what the time has to do with GPS. A lot, it turns out. GPS works by triangulating your distance from the satellites in the GPS constellation, which depends on knowing the exact position of the satellites. Since their orbits are corrected every so often, you must rely on so-called ephemeris data from each satellite, which is the required information to compute fairly exact orbits, and is updated fairly often (Wikipedia says GPS receivers should update ephemeris data every 4 hours). Originally this data is broadcast by the satellites themselves in their navigation message, at an awfully slow rate of 50 bits/s. You read it right, bits, not bytes or KB or MB, that's bits. As the navigation message is 1500 bits long, it takes at least 30 seconds to download it, which is about the time most standalone GPS receivers take to get a fix from a cold start (i.e. with stale ephemeris data). To work around this delay, most phones with GPS use the assisted-GPS variety, which downloads ephemeris data from a faster channel such as the cellular network. My theory is that some WTF-worthy excuse for an engineer at the carrier decided that, rather than doing time zone updates the right way, by updating configuration files to point to the new time zone, he'd just rather adjust the clock forward by one hour. The GPS chipset probably works with time zone neutral clocks so it asks for (say) UTC time and gets it off by one hour, and then computes the satellite orbits as though it were one hour later than it actually is. Obviously this means the triangulation computations go horribly wrong and rather than reporting something absurd, the chipset just pretends it couldn't get a fix.

It took a lot of complaining from a lot of people (to the carrier and to the government agencies responsible for telecommunications), but the carrier finally fixed the problem. However, it was a nightmare trying to deal with clueless customer support representatives who didn't try in the least to help (and probably were thinking all along `what does this wacko think GPS has to do with DST?'), just blindly suggesting that we restore the phone, or even try to uninstall the built-in Maps app, or blaming it on Apple and saying they weren't responsible -- and never mind that unlocked phones with SIM cards from other carriers worked fine, and that the iPhone support situation is unique in Brazil as Apple outsourced support to the carriers themselves. In the end, the customer support WTFs would be worth another post of its own, at least twice the size of this one.

But my faith in humanity is restored as someone, somewhere within the carrier, actually listened to these detailed explanations of the problem and how to fix it, and actually acted on it. I honestly thought it would take a class action lawsuit to fix it.

Input Devices

How To Enter Equations Quickly In Class? 823

Posted by timothy
from the napkins-and-a-digital-camera dept.
AdmiralXyz writes "I'm a university student, and I like to take notes on my (non-tablet) computer whenever possible, so it's easier to sort, categorize, and search through them later. Trouble is, I'm going into higher and higher math classes, and typing "f_X(x) = integral(-infinity, infinity, f(x,y) dy)" just isn't cutting it anymore: I need a way to get real-looking equations into my notes. I'm not particular about the details, the only requirement is that I need to keep up with the lecture, so it has to be fast, fast, fast. Straight LaTeX is way too slow, and Microsoft's Equation Editor isn't even worth mentioning. The platform is not a concern (I'm on a MacBook Pro and can run either Windows or Ubuntu in a virtual box if need be), but the less of a hit to battery life, the better. I've looked at several dedicated equation editing programs, but none of them, or their reviews, make any mention of speed. I've even thought about investing in a low-end Wacom tablet (does anyone know if there are ultra-cheap graphics tablets designed for non-artists?), but I figured I'd see if anyone at Slashdot has a better solution."
IT

How Do You Manage Dev/Test/Production Environments? 244

Posted by timothy
from the hotbed-of-hotbeds dept.
An anonymous reader writes "I am a n00b system administrator for a small web development company that builds and hosts OSS CMSes on a few LAMP servers (mostly Drupal). I've written a few scripts that check out dev/test/production environments from our repository, so web developers can access the site they're working on from a URL (ex: site1.developer.example.com). Developers also get FTP access and MySQL access (through phpMyAdmin). Additional scripts check in files to the repository and move files/DBs through the different environments. I'm finding as our company grows (we currently host 50+ sites) it is cumbersome to manage all sites by hacking away at the command prompt. I would like to find a solution with a relatively easy-to-use user interface that provisions dev/test/live environments. The Aegir project is a close fit, but is only for Drupal sites and still under heavy development. Another option is to completely rewrite the scripts (or hire someone to do it for me), but I would much rather use something OSS so I can give back to the community. How have fellow slashdotters managed this process, what systems/scripts have you used, and what advice do you have?"
Space

Astronomers Dissect a Supermassive Black Hole 77

Posted by kdawson
from the telescopes-are-where-you-find-them dept.
Matt_dk sends along a piece from the European Southern Observatory, which reports on observations of the so-called "Einstein Cross," a fortuitous conjunction of a nearby galaxy and a distant black hole. A team of researchers from Europe and the US combined the effects of macrolensing (from the intervening galaxy) and microlensing (from stars in that galaxy), captured by an earth-bound telescope. "Combining a double natural 'magnifying glass' with the power of ESO's Very Large Telescope, astronomers have scrutinized the inner parts of the disc around a supermassive black hole 10 billion light-years away. They were able to study the disc with a level of detail a thousand times better than that of the best telescopes in the world, providing the first observational confirmation of the prevalent theoretical models of such discs."
The Courts

Four Google Officials Facing Charges In Italy For Errant Video 153

Posted by ScuttleMonkey
from the looks-like-digging-for-deep-pockets-to-me dept.
mikesd81 writes to tell us that four Google employees may be facing charges of defamation and failure to control personal data simply because they didn't remove a video of a boy with Down's Syndrome being harassed and eventually hit over the head with a box of tissue, from Google Video. The video was posted in September of 2006 and was removed by Google within a day of receiving the initial complaints, but apparently that isn't fast enough. "Google maintains charges against the employees are unwarranted, Pancini said. Europe's E-commerce Directive exempts service providers from prescreening content before it is publicly posted, he said. Also, the video was technically uploaded to a Google server in the US, not in Italy, Pancini said. 'It was a terrible video,' Pancini said, adding that Google is concerned about the case's impact on censorship on the Internet. The defendants include David C. Drummond, a Google senior vice president, corporate development and chief legal officer. Pancini said Drummond did paperwork to create Google Italy, but has never lived in the country."
The Almighty Buck

Fuel Efficiency and Slow Driving? 1114

Posted by timothy
from the practical-interest-here dept.
vile8 writes "With the high gas prices and ongoing gas gouging in my hometown many people are trying to find a reasonable way to save gas. One of the things I've noticed is people driving exceptionally slow, 30mph in 45mph zones, etc. So I had to take a quick look and find out if driving slow is helpful in getting better mileage. I know horsepower increases substantially with wind resistance, but with charts like this one from truckandbarter.com it appears mileage is actually about the same between 27mph and 58mph or so. So I'm curious what all the drivers out there with the cool efficiency computers are getting ... of specific interest would be the hemis with MDS; how do those do with the cylinder shutoff mode at different speeds?" Related: are there any practical hypermiling techniques that you've found for people not ready to purchase a new car, nor give up driving generally?
Microsoft

Microsoft Bids To Take Over Open Document Format 256

Posted by kdawson
from the pinching-the-oxygen-feed dept.
what about sends in a Groklaw alert warning that, by PJ's reading, Microsoft may be trying to take over ODF via a stacked SC 34 committee. The article lists the attendees at an SC 34 meeting in July and gives their affiliations, which the official meeting materials do not. (The attendees of the October 1 meeting, which generated a takeover proposal to OASIS, are not known in full.) "Why do I say Microsoft, when this is SC 34? Look at this ... list of participants in the July meeting in Japan of the SC 34 committee. The committee membership is so tilted by Microsoft employees and such, if it were a boat, it would capsize ... Of the 19 attendees, 8 are outright Microsoft employees or consultants, and 2 of them are Ecma TC45 members. So 10 out of 19 are directly controlled by Microsoft/Ecma ... [I]f the takeover were to succeed, SC 34 would get to maintain ODF as well as Microsoft's competing parody 'standard,' OOXML. How totally smooth and shark-like. Under the guise of 'synchronized maintenance,' without which they claim SC 34 can't fulfill its responsibilities, they get control of everything." A related submission from David Gerard points out that BoycottNovell has leaked the ISO OOXML documents, which ISO has kept behind passwords.
Editorial

Linux Needs More Haters 617

Posted by Soulskill
from the dem's-fightin'-woids dept.
Corrupt brings us a ZDNet column by Jeremy Allison, who says Linux could benefit from more "tough love" in order to improve its functionality and popularity. Excerpting: "As Elie Wiesel said, 'the opposite of love is not hate, it is indifference.' LinuxHater really doesn't hate Linux, despite the name. No one takes that much time to point out flaws in a product that they completely loathe and despise. The complaints are really cries of frustration with a system that just doesn't quite do what is desired (albeit well disguised). A friend pointed out to me that the best way to parse LinuxHaters blog is to treat it as a series of bug reports. A perl script could probably parse out the useful information from them and log them as technical bug reports to the projects LinuxHater is writing about. Deep down, I believe LinuxHater really loves Linux, and wants it to succeed."
Databases

MagLev, Ruby VM on Gemstone OODB, Wows RailsConf 132

Posted by kdawson
from the rails-oh-i-get-it dept.
murphee ends along a report from InfoQ: "Gemstone demoed [MagLev,] their Ruby VM built on their GemStone S64 VM, to an ecstatic audience. Gemstone's Smalltalk VM allows OODBs of up to 17 PetaBytes, with none of the old ActiveRecord nonsense: the data is persisted transparently. The Gemstone OODB also takes care of any distribution, allowing the Ruby VM and data to scale across many servers (Cheerio, memcached!). There's also an earlier quite technical interview with Gemstone's Bob Walker and Avi Bryant about MagLev."
Portables

PC Superstore Admits Linux Hinge Repair Mistake 193

Posted by Zonk
from the there-are-some-happy-endings-after-all dept.
Erris writes "PC Superstore says their store manager was wrong to turn away a client with a broken hinge whose machine should have been repaired. 'El Reg put a call in to the DSGi-owned retail giant to get some clarification on PC World's Linux support policy. A spokesman told us that there had simply been a misunderstanding at the store and that, in fact, the normal procedure would be for the Tech Guys to provide a fix. [PC World] will provide a full repair once the firm has made contact with Tikka.'
BSD

OpenBSD Foundation Announced 151

Posted by samzenpus
from the check-it-out dept.
OpenBDSfan writes "KernelTrap is reporting on the creation of the OpenBSD Foundation, a Canadian not-for-profit corporation intended to support OpenBSD and related projects, including OpenSSH, OpenBGPD, OpenNTPD, and OpenCVS. The announcement explains, "the OpenBSD Foundation will initially concentrate on facilitating larger donations of equipment, funds, documentation and resources. Small scale donations should continue to be submitted through the existing mechanisms.""

For God's sake, stop researching for a while and begin to think!

Working...