Follow Slashdot stories on Twitter


Forgot your password?

Slashdot videos: Now with more Slashdot!

  • View

  • Discuss

  • Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).


Comment: Re:I should think so! (Score 1) 93

by fuzzyfuzzyfungus (#49159499) Attached to: Blu-Ray Players Hackable Via Malicious Discs
The whole point of my post was to suggest one method for causing trouble with URL requests, and I don't doubt that there are others.

However, that doesn't change the fact that, while basically every step of the process is potentially up for grabs, the URLs stamped into the disk are static. Short of replacing the disk nobody gets to change them.

If you control the JVM, you can rewrite them there, if you control the player's OS, you can rewrite them there, if you arrange for your host to be the one replying you can provide whatever response you wish, all true, all bad; but not the same as changing the URLs on the disk.

Comment: Re:And still (Score 1) 177

by TheRaven64 (#49157943) Attached to: One Astronomer's Quest To Reinstate Pluto As a Planet
If Pluto is a planet, then so is Eris (which is larger), and Earth's moon (around 5 times larger than Pluto) is possibly a binary planet. Ganymede, the largest moon in the solar system, is under 3% the mass of Earth and is about ten times bigger than Pluto. There are quite a lot of moons bigger than Pluto, so would you want to classify them all as planets?

Comment: Re: I should think so! (Score 3, Insightful) 93

by fuzzyfuzzyfungus (#49155807) Attached to: Blu-Ray Players Hackable Via Malicious Discs
I think that the apps are supposed to be signed(at least to get useful elevated priviliges, like access to the network or to the player local storage); but if a signed, legitimate, app makes a network request to a server that is no longer friendly, then it becomes a question of input validation, even if the application signing scheme is 100% in order and nobody screwed any part of that up.

Call me a pessimist; but I'd bet nontrivial money that a lot of the 'interactive' cruft that is pumped out to bulk up 'special edition' releases is barely up to the challenge of presenting a helpful error message if it gets a 404 from the remote host, much less not falling over and wagging its tail against moderately clever malice. In that case, it'd be a fully signed and approved app doing the work, but taking action based on (ill-founded) trust in content it downloaded.

Comment: Re:Best defense is not to care (Score 1) 93

by fuzzyfuzzyfungus (#49155565) Attached to: Blu-Ray Players Hackable Via Malicious Discs
I'd not be terribly interested in the capabilities of the players themselves(routers make better zombies and are way more internet facing and unlikely to be turned off, and generally atrocious on security); but I would be very, very, nervous about anything that serves as a nice, subtle, persistent implant on a LAN.

Even enterprises have a nasty habit of pretending that they can get away with a little sloppiness 'inside the firewall', and consumer gear often can't be persuaded not be absurdly trusting of anything that happens to share a subnet with, in the interests of ease-of-use, 'autodiscovery', and similar. If you can get an implant on one device, especially one that nobody is going to suspect(and may have few options, short of replacing, if they do), you can reinfect other devices as they pop up more or less at your leisure.

Comment: Re:Ha ha they used JAVA; morons! (Score 2) 93

by fuzzyfuzzyfungus (#49155521) Attached to: Blu-Ray Players Hackable Via Malicious Discs
Unfortunately, it's not just blu ray: 'BD-J' is their specific variant; but it is based on the so-called 'Globally Executable MHP', a truly horrifying acronym-standard-soup constructed to enable vaguely interoperable java-based UI atrocities for various flavors of set top box associated with DVB-T, DVB-S, and DVB-C(Basically, all digital broadcast and cable activity that isn't ATSC, ISDB, DTMB, or some fully proprietary oddball).

BD-J is North America's main point of contact with this delightful substance; but it enjoys near-total ubiquity in the parts of the world that also use DVB.

Comment: Re:I should think so! (Score 3, Interesting) 93

by fuzzyfuzzyfungus (#49155441) Attached to: Blu-Ray Players Hackable Via Malicious Discs
It doesn't rank terribly high on the list of choices, given that it would be a pain in the ass to get your malware pressed into a reasonable number of disks(without suitable insider access to the later stages of disk manufacture process, in which case you might have some real room for fun); but there is one little detail that might get rather ugly:

With 'BD Live', disks can be authored to include access to network resources, as well as locally stored assets, in their Java-driven interactive content stuff. Now, there is no way for an attacker to change the URLs a disk requests; but nor is there a way for anyone else to do so. Whatever was stamped into the disk at production will remain until the disk leaves use.

Given that companies come and go, and company interest in specific products tends to wane even faster, I would be very, very, very, surprised if the various companies releasing 'BD Live' disks have managed to always retain control of the domain names that their disks will attempt to access. It wouldn't be a terribly high value exploit; but since a disk will attempt to access exactly the same URLs until it dies, you might be able to score a steady trickle of reliable re-infections by snapping up any lapsed domains associated with BD Live disks and adding a little 'bonus content'.

Comment: Re:I should think so! (Score 4, Insightful) 93

by fuzzyfuzzyfungus (#49155343) Attached to: Blu-Ray Players Hackable Via Malicious Discs
I suspect that there are a number of ways in, given the usual attention given to firmware quality; but blu-ray isn't helped by having a security model marked by absolute paranoia about the precious 'content' escaping, combined with some amount of incompetence and a lot of pure apathy about any other security concern.

With both the BD+ vm and the BD-J stuff, there is a lot of attention paid to 'ooh, the an unauthorized player attempting to do unauthorized things with the content on the disk?!'; but the contents of the disk are largely treated as trusted and the playback device is treated almost entirely as a potential adversary, not as a potential target, either from the disk side or the network side.

Comment: Re:Simple methodology (Score 1) 343

by lgw (#49155025) Attached to: The Programmers Who Want To Get Rid of Software Estimates

How could it have "passed all its tests" if it wasn't connected to the rest of the system? It's hard to do agile without continuous integration; doesn't surprise me it was a mess. But integration blowups are the norm in my experience on waterfall projects - they're the main thing that leads to "the first 90% of the project, then the second 90% of the project".

But the primary win from agile is in avoiding throw-away work. You always work next on what's the most likely to survive unchanged, you only do the design work you need to write the code that you're going to work on (which often includes the entire high-level architecture for the first line of code, but still), you only document what you've actually done, and so on. Bridge specifications are unlikely to change after the project was funded. I've done sever 18-month waterfall software projects, and never seen one where more than half of what we thought the project was at the beginning was what we delivered at the end. Make it cheap and easy to change the requirements, because the requirement are going to change, and there's no holding back the tide.

Comment: (Score 4, Informative) 178

by lgw (#49154923) Attached to: Google Taking Over New TLDs

I think .dev should be like not able to register so DEVELOPERS (re: NOT GOOGLE) can use like, [mydomain].dev to develop, and not have to create wonky local host names.

RFC 2606 reserves 4 TLDs for this purpose: .test .example .invalid .localhost

I've always used .test for domains for QA/test deployments. It also reserves the example.* second level domain name across all TLDs.

I think there are some other reserved TLDs, including ".xy" and some 63-character name that was something like "sixtythreecharacterdomainnamefortestingpurposes" , but I can't find the RFC. Anyone?

Comment: Re:Simple methodology (Score 1) 343

by lgw (#49154381) Attached to: The Programmers Who Want To Get Rid of Software Estimates

The person who "owns" the project. Generally they run it, as it's their ass in the fire.

Ah, well, the ideal anyway for Agile is that's the team.

don't believe I've been on an agile project where PMs did not run the scrums.

Wait, what? OK, by "PM" do you mean Product Manager (guy who's constantly visiting customers, or at least on the phone with them, often has an MBA), or a Project Manager (useless wanker). I've never seen Agile done well at companies that still employed the latter (but then I've never done consulting).

I always agree to a core scope that must be met, and then the nice to haves that are negotiable. This approach leads me to a much better success rate, happier clients, and successful projects

I agree that's the secret.

The agile approach has left disaster and/or disappointment everywhere I've seen it. Because the world is promised, and only some is delivered, on "successful" projects

Sounds like "Scrum consultants" selling snake oil, then moving on to the next victims ahead of the angry mob. Agile achieves 3 things if done right: much less throw-away work, early integration for fewer last-minute surprises, and a dev team who's emotionally committed to the dates, rather than hating management for the dates and wanting to hurt them in return. Those can make a pretty significant difference, but if you have intelligent, non-dickish management to begin with then only the first really changes (and if management is bad enough, nothing gets better).

Comment: Re:White balance and contrast in camera. (Score 1) 362

by TheRaven64 (#49154111) Attached to: Is That Dress White and Gold Or Blue and Black?
Zoom right in on the bits that you think are white, so that they fill your entire monitor. They're obviously blue. For a lot of us, that's the colour that we see when we look at it in context as well. I can see how you'd interpret it as being white by overcompensating for the colour in the bottom right, but that doesn't stop you from being wrong. The gold bits are gold when you zoom in (mostly, some are black), but a shiny black often looks yellow-gold in overexposed photos.

Show me a man who is a good loser and I'll show you a man who is playing golf with his boss.