Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
×

Comment Re:That's OK. (Score 1) 122

Yeah, that and the companies who don't want to do "military applications" can just do pure research. Pure, ivory-tower research... which the DoD can just pay someone else to integrate into an actual weapon system. It's not like a machine learning algorithm knows or cares to what use it's put, once it is out there.

Dumb posturing; I also wonder if these people have considered what a world dominated by Chinese and Russian military AI will look like, and what effect it would have... I am not sure it would be the best of all possible worlds, exactly.

Comment Re:Loss of revenue (Score 1) 176

I doubt this has been lost on the DefCon organizers. Presumably they think that they'd lose more attendance by moving to Europe than by having people who can't safely travel to the US just not come, or attend/present via videoconference or something. And I suspect that's probably true -- very few people (in my experience) go to DefCon or similar conferences on their own dime; you go on your employer's money. And getting your employer to comp you a few hundred bucks for a flight to Vegas and a shitty hotel room (Vegas hotel rooms are notoriously cheap) is a heck of a lot easier than getting a company to cough up for a transatlantic ticket, hotel in Europe, etc. As long as the majority of the attendees are in the US, this is where the conferences are going to be.

But coming here if you're involved in cybercrime is probably, uh, not a very smart idea. That Hutchins came at all suggests to me that he didn't know that the FBI was onto his alleged previous (pre-Wannacry) activities; the alternative is that he's dumb, and he doesn't seem dumb. (Though a fair number of very smart people are also arrogant and don't give other people credit for being able to figure things out, so that's also an option, I suppose.)

There is a legitimate question as to whether there should be some sort of cyber amnesty program, though, given the number of mostly-legitimate "security researchers" who have shady backgrounds but seem to have moved on from them. I've got some mixed feelings on that. On one hand, getting blackhats and their knowledge out into the open so vulns can be remediated and the network in general made more robust is a Good Thing. But I don't know if it outweighs the message it would send, which is that you can basically play Computer Mafioso when you're young and then retire to a nice, secure, respectable position as "security researcher" without the threat of your prior activities coming back to bite you. That's not really how things work in the non-IT world; if you spend your 20s working for the Mob, and then retire to a respectable profession, that respectability is unlikely to protect you from getting a knock on your door sometime later, depending on the statue of limitations, for stuff you did earlier. Might make a judge or jury go easier on you, but it's not an ironclad defense.

Comment Re:No good deed goes unpunished (Score 1) 176

I think it's more like "one good deed today doesn't get you off the hook for the bad deed you did last week".

In other words, if you're a blackhat who happens to take down another blackhat, that doesn't buy you a get-out-of-jail-free card that you can play when other things you may have done in the past surface.

Or at least, not to an extent that stops you from getting indicted. It might play pretty well in court if the whole thing actually goes to trial, I'd imagine. Can't hurt anyway.

Comment Re:TFS just has marketing (Score 2, Interesting) 71

Yeah I'd like some more meat to the story as well. Amazon Glacier achieves its pricing by using low-RPM consumer drives plugged into some sort of high-density backplanes; supposedly they are so densely packed that you can only spin up a few drives at once due to power and heat issues. Hence the delay.

I assume Google is doing something similar, maybe with somewhat better power or cooling since they're offering faster retrieval times which implies that perhaps they can spin up a higher percentage of drives at a time.

Comment Re:Orbital (Score 1) 443

It's not a terribly serious setback in the history of space flight, but it could be a serious blow to Orbital.

Their whole program is built around the idea of using old surplus Soviet-era rocket engines, originally designed for the ill-fated N1 program. (The N1 program, as a sidenote, is responsible for one of the largest non-nuclear explosions in human history when one of its launch vehicles had a failure shortly after takeoff. On top of a zero-for-four launch record, it's not the program I'd pick to emulate.)

My understanding of the Soviet engines is that they have some design features that make them lightweight for their output, but represent tradeoffs not typically taken on Western engines, due to the risk of "burn through". But some people--perhaps including Orbital--thought that the designers had solved the problem and the risks were overstated.

Too early to tell right now, but if the engines turn out to have a fatal flaw, that would be bad for Orbital. It'd probably be good for SpaceX, since they're the obvious alternative, but it'd leave NASA down one contractor for the commercial launch program.

Submission + - Ask Slashdot: After TrueCrypt (slashdot.org)

TechForensics writes: (Resubmitted because was not identified as "Ask Slashdot"

We all know the TrueCrypt story-- a fine, effective encryption program beginning to achieve wide use. When you see how the national security agency modified this tool so they could easily overcome it, you'll probably understand why they don't complain about PGP anymore. The slip that showed what was happening was the information that NSA "were really ticked about TrueCrypt" either because they couldn't circumvent it or found it too difficult. From the standpoint of privacy advocates, NSA's dislike for TrueCrypt was evidence it was effective.

Next, NSA directly wrapped up the makers of TrueCrypt in legal webs that made them insert an NSA backdoor and forbade them from revealing it was there. It's only because of the cleverness of the TrueCrypt makers the world was able to determine for itself that TrueCrypt was now compromised. (Among other things, though formerly staunch privacy advocates, the makers discontinued development of TrueCrypt and recommended something like Microsoft Bitlocker, which no one with any sense believes could be NSA – hostile. It then became logically defensible, since NSA was not complaining about PGP or other encryption programs, to posit they had already been compromised.

This is the situation we have: all of the main are important encryption programs are compromised at least in use against the federal government. Whether NSA tools are made available to local law enforcement is not known. This all begs the question:

Does the public now have *any* encryption that works? Even if we can see the source code of the encryption algorithm the source code of the program employing that algorithm must be considered false. (TrueCrypt was the only program NSA complained about.) In the case of other software, it becomes believable the NSA has allowed to be published only source code that hides their changes, and the only way around that may be to check and compile the published code yourself. Half the public probably doesn't bother.

Okay, Slashdot, what do you think? Where do we stand? And what ought we to do about it?We all know the TrueCrypt story-- a fine, effective encryption program beginning to achieve wide use. When you see how the national security agency modified this tool so they could easily overcome it, you'll probably understand why they don't complain about PGP anymore. The slip that showed what was happening was the information that NSA "were really ticked about TrueCrypt" either because they couldn't circumvent it or found it too difficult. From the standpoint of privacy advocates, NSA's dislike for TrueCrypt was evidence it was effective.

Next, NSA directly wrapped up the makers of TrueCrypt in legal webs that made them insert an NSA backdoor and forbade them from revealing it was there. It's only because of the cleverness of the TrueCrypt makers the world was able to determine for itself that TrueCrypt was now compromised. (Among other things, though formerly staunch privacy advocates, the makers discontinued development of TrueCrypt and recommended something like Microsoft Bitlocker, which no one with any sense believes could be NSA–hostile. It then became logically defensible, since NSA was not complaining about PGP or other encryption programs, to posit they had already been vitiated.

This is the situation we have: all of the main or important encryption programs are compromised at least in use against the federal government. Whether NSA tools are made available to local law enforcement is not known. This all begs the question:

Does the public now have *any* encryption that works? Even if we can see the source code of the encryption algorithm the source code of the program employing that algorithm must be considered tainted. (TrueCrypt was the only program NSA complained about.) In the case of other software, it becomes believable the NSA has allowed to be published only source code that hides their changes, and the only way around that may be to check and compile the published code yourself. Half the public probably doesn't bother. (Would it not be possible for the NSA to create a second TrueCrypt that has the same hash value as the original?)

Okay, Slashdot, what do you think? Where do we stand? And what ought we to do about it?

Comment Re:Interesting... (Score 1) 133

In the US, trademarks only extend as far as someone might be confused by their use. It's not a hard black and white line, but you can use "Word" if you wanted to, in an unrelated industry from Microsoft's, provided that nobody thought that customers might be confused and think that your product was, or was in some way related to, Microsoft's. (Obviously since Microsoft is such a big company and does so much stuff, this might be harder than if they were purely in the word processing business.)

A good example is Apple Records vs Apple Computer Corp. There was a lot of argument that went back and forth as to whether Apple Computers might be confused with Apple Records -- which seemed ridiculous at the time, because why would Apple Computer ever get into the music business? So they worked it out and came to a settlement to stay out of each other's turf. That happens very frequently. (It got interesting when Apple-the-computer-company decided to get into the music business; my understanding is that they made Apple Records an offer they couldn't refuse.)

And given how ubiquitous Microsoft's products are -- love them or hate them -- the breadth of their trademarks are probably not unreasonable. A no-name company ought not be able to assert a trademark with any similar breadth, because there's so little chance of confusion.

Comment Re:Use it or lose it (Score 1) 133

Well they are registered in the .com TLD, which is basically United States namespace, so it would make sense that US trademark law would apply at least in terms of the domain name. I doubt some European company would be able to convince a US court to order Verisign to turn over the domain to them.

So at worst, I would think that Pinterest could continue to operate under the "Pinterest.com" domain name; the challenge would be whether they want to advertise in the European market, which might be prohibited without changing their name.

Comment Re:What is Bruce Schneier's game? (Score 1) 397

If the NSA were to require them to install a secret backdoor then the NSA would be compromising the security of all of their government customers because they don't sell two different versions of their software, it is the same for all customers.

Unless the product has been certified for use with classified information, that's not much of an assurance. The government has its own internally-developed tools -- which presumably it has confidence in (SIPRNet, etc.) -- for protecting information that it deems sensitive. The NSA might well decide that subverting a commercial tool is worth the risk of compromising something that's used by the government, but only in relatively trivial ways.

I don't know enough to impugn Zimmerman et al, but I don't think "it's used by the government!" is necessarily a great seal of approval, unless it's a formal certification (e.g. NSA Type 1 listing) saying that it can be used to protect classified information. And I'm not aware of any COTS software products that are on the Type 1 list; the NSA only approves particular hardware implementations (at least that I've seen, though I'm happy to be corrected although I'd be surprised).

Submission + - 3D Space Epic Game Released on Linux (salvationprophecy.com)

An anonymous reader writes: Salvation Prophecy has space ship dog-fights, planetary battles, alien planets to explore, and a command room to order new colonies, space stations, and military attacks. The linux port is solid, and supports full screen, a variety of input devices (keyboard-mouse, joystick, gamepad), and plays really smooth on any reasonably modern mid-level video card.
Security

Submission + - Ask Slashdot:How to protect a text document 6

Jason1729 writes: I have been ordered by judge to release a large amount of material in "electronic format". Typically it's only available as paper copies which are sold on copy protected paper. Illegal copying of this material has become rampant and a group of lawyers obtained the court order by claiming it would be easier for them to access the material on a computer screen rather than hard copy. It is fairly clear they intend to print and share the single copy rather than paying for certified copies.

I'm looking for a technological solution that will allow me to distribute the documents (with word processing formatting in tact), in "electronic format", complying with the letter of the court order, but also make it impossible or as difficult as possible to print the documents or share the electronic version.

I'd rather not get into a discussion on the morality of copyright as the cost to produce the material was far greater than the single copy price and had I known I'd be facing this court order, I'd have refused to create it to begin with. Total demand is around 5 copies and getting 20% of that means losing a lot of money.

Submission + - Computer Repair Company Takes Revenge on Devious Customer (callnerds.com) 3

herrshuster writes: Nerds on call, a small computer repair company, was sued for $500,000 dollars by a customer claiming that they had lost critical information in his litigation. But when they looked into his history, they found this was not the first time he had tried to get money from a company through either his own error or ignorance: http://blog.oregonlive.com/complaintdesk/2011/07/when_store_clerks_give_advice.html In retaliation, they posted an explanation of the circumstances on their site that totalled more than 17,000 words in an attempt to google-bomb his name. Their closing statement: "In the end we won’t label him a scam artist, or assume he had nefarious intent, however, we will let the entire history of our interactions with him stand on their own."
Censorship

Submission + - article critical of Microsoft pulled from forbes.com (googleusercontent.com)

darkeye writes: An article titled 'Sell Microsoft NOW! Game Over — Ballmer Loses' (http://www.forbes.com/sites/adamhartung/2013/01/20/sell-microsoft-now-game-over-ballmer-loses/) by Adam Hartung has been pulled from forbes.com. The article is still available via the Google WebCache here: http://webcache.googleusercontent.com/search?q=cache:Z07qoZSJTV8J:www.forbes.com/sites/adamhartung/2013/01/20/sell-microsoft-now-game-over-ballmer-loses/
  . While Microsoft is clearly on the decline, it seems it still has for enough reaching hands to sensor content on a major publication like Forbes.

Slashdot Top Deals

All great discoveries are made by mistake. -- Young

Working...