Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror

Comment Re:Ha ha ha ha..... (Score 1) 79 79

Rate me -1 troll, but I think it's hilarious that "the science fiction future" for which everyone is optimistically hoping is being brought to us by something so prosaic and "dirty" and anti-utopian as murdering people.

Clearly, we need a major war which absolutely requires that every soldier be equipped with a personal jetpack.

Comment Re:Shooting Guns into the Air in a Populated Area (Score 1) 929 929

Discharging any weapon in a populated area except at a proper range or in defense of your life is generally illegal and a very bad idea.

Often illegal, yes. Firing birdshot into the air is not dangerous. That's why we use shotguns and birdshot to shoot birds. From the air. Birdshot's terminal velocity is low enough that by the time the shot falls to the ground it's not dangerous.

Comment Re:"...the same as trespassing." (Score 4, Insightful) 929 929

I dont know about Kentucky, however in Texas you can shoot people for Criminal Trespass. You can use deadly force to protect your self and your property.

Texas is the only state that allows deadly force to be used in defense of property. This is a case where Texas is wrong and the rest of the country is right. I'm all for the right to keep and bear arms, I carry daily and am a certified concealed weapons instructor. But deadly force should only be used to defend people, not stuff.

Comment Re:Fire without physically pulling the trigger (Score 2) 52 52

Every redneck knows how: Just clean it.

Only fools try to clean or work on their weapon without unloading it.

This.

Further, even after you've unloaded it you should still obey the golden rule of gun safety: never point it at anything you don't want to destroy. If what you're doing requires breaking that rule, first disassemble it so it's no longer a gun. Then, and only then, can you stop worrying about where you're pointing it.

The reason for this is that most people who hurt themselves or others while cleaning their gun *did* unload it first. Or thought they did.

Comment Wrong age (Score 4, Insightful) 266 266

Relatively little of what teens do is going to cause them problems in later life. It's what people do between about 18 and 25 that tends to screw them. Mainly because they're old enough to drink (without having to hide it) but not yet old enough to think (well).

Comment Re:Anti tracking plugin for Chrome?? (Score 1) 60 60

Whatever you do you are still being tracked by default, that is the point of Chrome.

Do you have any evidence to back that claim up?

There are a number of features in Chrome that optionally talk to Google. But you can change them all if you prefer. Do you have any proof that it "phones home" in any hidden way? It should be quite easy to prove; Wireshark is all you need.

FWIW, I know some of the guys who started the Chrome project. Actually, they didn't start Chrome, they started V8. The point was to prove that Javascript engines could be orders of magnitude faster than they were, and to push the rest of the industry to get better, so Google's apps would be able to do more, faster. The rest of Chrome was just to show off V8. Then it became successful, both at pushing Javascript engines to get better, and as a popular browser, and Google started to use it as a test bed for other ideas about how to make the web "platform" better. Security improvements like certificate pinning. Performance (and security) improvements like SPDY and QUIC. UI simplifications like the omnibox (which geeks like to hate, but non-geeks love). Better development tools (though Firebug was and is quite good). And so on.

I don't think "better tracking of users" has ever been a goal, stated or unstated, of the Chrome project. And, seriously, why would it? It's not like the normal web standards don't offer everything that's required for whatever tracking anyone would like to do.

Comment Re:OpenID Connect scales at O(n^2) (Score 1) 364 364

Trial and error, I expect. Look at what other sites do. I realize that this isn't a very good answer. There isn't a good answer, just bad answers that are still better than passwords. Classic OpenID isn't the answer because users don't know how to use it and many RPs don't trust random providers. But as a practical matter providing login with, say, Google, Facebook, Yahoo and AOL will give better than 95% of your users the ability to log on with better security than the password-based model you'd build, and do it just by clicking a couple of buttons.

If you find that your user base tends to have an account with some other provider (no, I can't tell you how to find out who your users are or what they use), then add that.

Comment Re:Wait, you have to TYPE the password??? (Score 1) 364 364

When the services go down, you can't log in to the relying sites. Luckily, core infrastructure like the account systems is a very high priority for the engineers, and the big providers have plenty of resources to keep them up -- and they do. My bank's site is down far, far more often than Google's auth servers, for example. How much more often? I don't know... I've never seen Google's auth servers down.

Comment Re:OpenID Connect scales at O(n^2) (Score 1) 364 364

Pick the top several and you'll cover nearly everyone. For the tiny percentage of users that remains, you have to either offer password auth (which means all of the work and risks of maintaining a password system, but at least when you screw it up only a tiny percentage of your users will be affected) or push them to get an account with one of the providers you support.

Comment Re:Wait, you have to TYPE the password??? (Score 1) 364 364

Copy/paste cache scrapers exist, and are common for browsers with bugs. Training people not to copy/paste passwords is a good idea.

You're promoting perpetuating a long-standing, widespread and hugely-damaging user security error in order to avoid a relatively obscure problem which can actually be fixed through purely technical means. Not a win.

Comment Re:OpenID Connect scales at O(n^2) (Score 1) 364 364

What you describe as a problem is actually part of the solution. The problem with classic OpenID was that it was virtually impossible to get, say 1st Bank of MyButt, to use it, because absolutely anyone could be an identity provider. I personally agree with you that classic OpenID was better in that respect, but 1st Bank of MyButt doesn't. They're hemming and hawing about letting Google manage their user's identities, but they will at least consider it.

Comment Re:Wait, you have to TYPE the password??? (Score 1) 364 364

You're actually very wrong. Long complicated passwords are horrifically impossible to remember causing people to write them down or store them in managers with simpler passwords to open the manager.

Putting them in password managers is the right thing to do.

Length is all that matters for passwords. You're better off with "thatswhatshesaid" (26 ^ 16) than "B4c0nL0v3r!" (72 ^ 11). You're 162 times better off, in fact.

26 ^ 16 = 43,608,742,899,428,874,059,776 72 ^ 11 = 269,561,249,468,963,094,528

https://xkcd.com/936/

You're wrong. Hilariously so.

The entropy of "thatswhatshesaid" is far lower than 43,608,742,899,428,874,059,776. Randall Munroe calculated correctly in the XKCD comic, of course. He didn't assume that each letter was random, he assumed he was choosing four words at random from a dictionary of a specific size (about 2048 entries == ~11 bits of entropy per word). Your password is clearly not a selection of randomly-chosen words, and even if it were, it would likely have been from a much smaller dictionary.

This highlights the danger of asking users to pick passwords... even those who think they know what they're doing are likely to screw it up. Munroe's advice in 936 was good... but I think it has mislead more people than it has enlightened.

No, it's much better to use a password manager and let a computer pick large random passwords for you.

Comment Re:Wait, you have to TYPE the password??? (Score 3, Interesting) 364 364

If your password is "OPnuo(I&n hKUYNB68IOnih4wOIB*GBi234t73" as it should be,* then yes...

Parent was modded funny, but this is what your passwords should look like -- long and random, and typing them is a PITA. Any web site that disables pasting or prevents your browser or extensions from auto-filling passwords is broken. The sad thing is that most sites that do this (other than those that do it by accident because the devs are clueless) do it because they think they're increasing the security of their users' accounts. They're not.

Solutions like LastPass et al are the best, but honestly just using your browser's password database is better than reusing passwords everywhere. And Chrome and Firefox (at least, perhaps others) offer the option of keeping your passwords synced to all of the devices you use, optionally protected with a master password. Browsers need to offer password generation as well. I think some are working on it.

Of course, the real solution is to get rid of passwords. Web sites should switch to using OpenID authentication. Yes this means that most users will use their Facebook or Google logins, which means that, essentially, the site has outsourced its account security to those other entities. So what? If the developers of random web sites think they can do a better job of account security than Google or Facebook -- they're wrong . I work for Google and previously spent a decade as a security consultant in the financial industry and after seeing how they all work from the inside, I would feel much more secure about my bank account if I could use my Google account (with 2FA, plus all of the analytics and monitoring Google does) to log into it rather than trusting the bank to do a decent job with password-based security. I haven't seen Facebook's infrastructure, but I know people who work there, and they're good. Far better than you'll find at a typical bank, much less J. Random Web Developer.

The reward of a thing well done is to have done it. -- Emerson

Working...